# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Sep 16 2019 10:43:25 # Log Creation Date: 13.10.2019 07:44:57.826 Process: id = "1" image_name = "gasas.exe" filename = "c:\\users\\fd1hvy\\desktop\\gasas.exe" page_root = "0x112b7000" os_pid = "0x49c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x47c [0035.720] GetVersion () returned 0x23f00206 [0035.721] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0035.754] GetProcAddress (hModule=0x75e90000, lpProcName="IsTNT") returned 0x0 [0035.754] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1fa0000 [0035.755] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x2020000 [0035.755] VirtualAlloc (lpAddress=0x2020000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2020000 [0035.756] GetCurrentThreadId () returned 0x47c [0035.756] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\" " [0035.756] GetEnvironmentStringsW () returned 0x687c78* [0035.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0035.757] RtlAllocateHeap (HeapHandle=0x1fa0000, Flags=0x0, Size=0x570) returned 0x1fa05a8 [0035.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1fa05a8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0035.757] FreeEnvironmentStringsW (penv=0x687c78) returned 1 [0035.757] RtlAllocateHeap (HeapHandle=0x1fa0000, Flags=0x0, Size=0x480) returned 0x1fa0b20 [0035.757] GetStartupInfoA (in: lpStartupInfo=0x19f8c4 | out: lpStartupInfo=0x19f8c4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0035.757] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0035.757] GetFileType (hFile=0x0) returned 0x0 [0035.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.757] GetFileType (hFile=0x0) returned 0x0 [0035.757] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0035.757] GetFileType (hFile=0x0) returned 0x0 [0035.757] SetHandleCount (uNumber=0x20) returned 0x20 [0035.757] GetACP () returned 0x4e4 [0035.757] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8ec | out: lpCPInfo=0x19f8ec) returned 1 [0035.757] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6610c528, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0035.758] HeapFree (in: hHeap=0x1fa0000, dwFlags=0x0, lpMem=0x1fa05a8 | out: hHeap=0x1fa0000) returned 1 [0035.758] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x75e90000 [0035.759] GetProcAddress (hModule=0x75e90000, lpProcName="IsProcessorFeaturePresent") returned 0x75ea5960 [0035.759] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0035.759] RtlAllocateHeap (HeapHandle=0x1fa0000, Flags=0x8, Size=0x800) returned 0x1fa0fa8 [0035.770] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0035.770] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x14c [0035.771] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0035.771] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x6610e6c8, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0035.771] GetVersion () returned 0x23f00206 [0035.771] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0035.773] GetUserDefaultLCID () returned 0x409 [0035.773] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0035.773] GetSystemMetrics (nIndex=5) returned 1 [0035.773] GetSystemMetrics (nIndex=6) returned 1 [0035.773] GetSystemMetrics (nIndex=11) returned 32 [0035.773] GetSystemMetrics (nIndex=12) returned 32 [0035.773] GetSystemMetrics (nIndex=34) returned 136 [0035.773] GetSystemMetrics (nIndex=35) returned 39 [0035.773] GetSystemMetrics (nIndex=0) returned 1440 [0035.773] GetSystemMetrics (nIndex=1) returned 900 [0035.773] GetSystemMetrics (nIndex=32) returned 8 [0035.773] GetSystemMetrics (nIndex=33) returned 8 [0035.773] GetSystemMetrics (nIndex=42) returned 0 [0035.774] GetStockObject (i=15) returned 0x88000b [0035.774] GetStockObject (i=7) returned 0xb00017 [0035.774] GetStockObject (i=6) returned 0xb00018 [0035.774] GetStockObject (i=8) returned 0xb00016 [0035.774] GetStockObject (i=4) returned 0x900011 [0035.774] GetStockObject (i=2) returned 0x900012 [0035.774] GetStockObject (i=0) returned 0x900010 [0035.774] GetStockObject (i=5) returned 0x900015 [0035.774] GetStockObject (i=13) returned 0x8a01c2 [0035.774] GetDC (hWnd=0x0) returned 0x10105d6 [0035.774] GetTextExtentPointA (in: hdc=0x10105d6, lpString="0", c=1, lpsz=0x19f8e8 | out: lpsz=0x19f8e8) returned 1 [0035.780] GetDeviceCaps (hdc=0x10105d6, index=14) returned 1 [0035.780] GetDeviceCaps (hdc=0x10105d6, index=12) returned 32 [0035.780] GetDeviceCaps (hdc=0x10105d6, index=88) returned 96 [0035.780] GetDeviceCaps (hdc=0x10105d6, index=90) returned 96 [0035.780] GetDeviceCaps (hdc=0x10105d6, index=38) returned 32409 [0035.780] ReleaseDC (hWnd=0x0, hDC=0x10105d6) returned 1 [0035.780] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x1f70000 [0035.781] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e7d0 | out: ppMalloc=0x6610e7d0*=0x75e4d000) returned 0x0 [0035.781] GetCurrentThreadId () returned 0x47c [0035.781] GetStartupInfoA (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0035.781] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x104) returned 0x1f705a8 [0035.781] GetCurrentThreadId () returned 0x47c [0035.781] GetCurrentThreadId () returned 0x47c [0035.782] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xec8) returned 0x1f706b8 [0035.782] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\" " [0035.782] lstrlenA (lpString="") returned 0 [0035.782] lstrcpyA (in: lpString1=0x19fea4, lpString2="" | out: lpString1="") returned="" [0035.782] SetErrorMode (uMode=0x8001) returned 0x0 [0035.782] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x19fb60, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0035.782] GetUserDefaultLCID () returned 0x409 [0035.782] lstrcpyA (in: lpString1=0x19f860, lpString2="*" | out: lpString1="*") returned="*" [0035.782] LoadStringA (in: hInstance=0x66000000, uID=0x7d1, lpBuffer=0x19fc64, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0035.782] GetSystemDefaultLCID () returned 0x409 [0035.782] GetUserDefaultLCID () returned 0x409 [0035.782] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x19fc6e, cchData=2 | out: lpLCData=".") returned 2 [0035.782] GetStockObject (i=13) returned 0x8a01c2 [0035.782] GetObjectA (in: h=0x8a01c2, c=60, pv=0x19fc34 | out: pv=0x19fc34) returned 60 [0035.782] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x19fc30, cchData=4 | out: lpLCData="ENU") returned 4 [0035.782] lstrcpyA (in: lpString1=0x19fc60, lpString2="EN" | out: lpString1="EN") returned="EN" [0035.783] lstrlenA (lpString="{xx}") returned 4 [0035.783] lstrlenA (lpString="VB98.CHM") returned 8 [0035.783] lstrcpyA (in: lpString1=0x6610eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0035.783] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x19fc30, cchData=4 | out: lpLCData="ENU") returned 4 [0035.783] lstrcpyA (in: lpString1=0x19fc60, lpString2="EN" | out: lpString1="EN") returned="EN" [0035.783] lstrlenA (lpString="{xx}") returned 4 [0035.783] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0035.783] lstrcpyA (in: lpString1=0x6610ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0035.783] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fd88, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0035.783] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x19fc84, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0035.783] lstrcpynA (in: lpString1=0x19fb68, lpString2="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL") returned="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" [0035.783] lstrlenA (lpString="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL") returned 32 [0035.783] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x21) returned 0x1f71588 [0035.783] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x21) returned 0x1f715b8 [0035.783] lstrcpyA (in: lpString1=0x1f71588, lpString2="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" | out: lpString1="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL") returned="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" [0035.783] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", cchSrc=-1, lpDestStr=0x19fb48, cchDest=260 | out: lpDestStr="C:\\USERS\\FD1HVY\\DESKTOP\\GASAS.EXE") returned 34 [0035.784] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x19fc4c, dwRevision=0x1 | out: pSecurityDescriptor=0x19fc4c) returned 1 [0035.784] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x19fc4c, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x19fc4c) returned 1 [0035.784] CreateSemaphoreA (lpSemaphoreAttributes=0x19fc60, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?USERS?FD1HVY?DESKTOP?GASAS.EXE") returned 0x160 [0035.784] GetLastError () returned 0x0 [0035.784] GetVersionExA (in: lpVersionInformation=0x19fbc4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19fbc4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0035.784] OleInitialize (pvReserved=0x0) returned 0x0 [0036.424] OaBuildVersion () returned 0x321396 [0036.424] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x75bb0000 [0036.425] GetLastError () returned 0x0 [0036.425] GetProcAddress (hModule=0x75bb0000, lpProcName="OleLoadPictureEx") returned 0x75c1e5f0 [0036.425] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc151 [0036.425] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc07a [0036.425] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBFocusRT6", lpWndClass=0x19fc2c | out: lpWndClass=0x19fc2c) returned 0 [0036.425] RegisterClassA (lpWndClass=0x19fc2c) returned 0xc16d [0036.425] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBBubbleRT6", lpWndClass=0x19fc2c | out: lpWndClass=0x19fc2c) returned 0 [0036.425] RegisterClassA (lpWndClass=0x19fc2c) returned 0xc16c [0036.425] HeapCreate (flOptions=0x0, dwInitialSize=0x400, dwMaximumSize=0x0) returned 0x27d0000 [0036.426] GetUserDefaultLCID () returned 0x409 [0036.426] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x3a4) returned 0x1f715e8 [0036.426] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x3a4) returned 0x1f71998 [0036.426] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xd4) returned 0x1f71d48 [0036.426] GetSystemInfo (in: lpSystemInfo=0x19fbec | out: lpSystemInfo=0x19fbec*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0036.426] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x1f20000 [0036.426] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0036.426] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0036.427] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0036.427] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0036.427] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0036.427] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0036.427] VirtualProtect (in: lpAddress=0x1f20000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x19fc48 | out: lpflOldProtect=0x19fc48*=0x4) returned 1 [0036.429] GetCurrentProcess () returned 0xffffffff [0036.429] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1f20000, dwSize=0x6000) returned 1 [0036.429] GlobalAddAtomA (lpString="VBDisabled") returned 0xc0b6 [0036.429] GetVersion () returned 0x23f00206 [0036.429] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x75bb0000 [0036.429] GetProcAddress (hModule=0x75bb0000, lpProcName="DispCallFunc") returned 0x75beb8f0 [0036.429] GetProcAddress (hModule=0x75bb0000, lpProcName="LoadTypeLibEx") returned 0x75bc63f0 [0036.429] GetProcAddress (hModule=0x75bb0000, lpProcName="UnRegisterTypeLib") returned 0x75c04910 [0036.429] GetProcAddress (hModule=0x75bb0000, lpProcName="CreateTypeLib2") returned 0x75be6040 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDateFromUdate") returned 0x75bd2cb0 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarUdateFromDate") returned 0x75bd2dc0 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="GetAltMonthNames") returned 0x75c1acd0 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNumFromParseNum") returned 0x75bd5920 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarParseNumFromStr") returned 0x75bc9490 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromR4") returned 0x75bc3090 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromR8") returned 0x75c1f1a0 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromDate") returned 0x75c1f000 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromI4") returned 0x75c1f0f0 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromCy") returned 0x75c1efc0 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR4FromDec") returned 0x75c1f7b0 [0036.430] GetProcAddress (hModule=0x75bb0000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x75bd2220 [0036.431] GetProcAddress (hModule=0x75bb0000, lpProcName="GetRecordInfoFromGuids") returned 0x75c1e250 [0036.431] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetRecordInfo") returned 0x75c1e9a0 [0036.431] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArraySetRecordInfo") returned 0x75bd3550 [0036.431] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetIID") returned 0x75c1e960 [0036.444] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArraySetIID") returned 0x75bd1a60 [0036.444] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayCopyData") returned 0x75bd3ee0 [0036.444] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x75bd36b0 [0036.444] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayCreateEx") returned 0x75bd35c0 [0036.444] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormat") returned 0x75be8000 [0036.444] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatDateTime") returned 0x75c21240 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatNumber") returned 0x75c21290 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatPercent") returned 0x75c21340 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatCurrency") returned 0x75c21180 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarWeekdayName") returned 0x75c21480 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMonthName") returned 0x75c213e0 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAdd") returned 0x75bed610 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAnd") returned 0x75be3200 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCat") returned 0x75be2f10 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDiv") returned 0x75c15800 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarEqv") returned 0x75c16160 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarIdiv") returned 0x75c161a0 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarImp") returned 0x75c16320 [0036.445] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMod") returned 0x75c16400 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMul") returned 0x75bedb10 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarOr") returned 0x75c16610 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarPow") returned 0x75c15e40 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarSub") returned 0x75bee3e0 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarXor") returned 0x75c167b0 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAbs") returned 0x75c14ca0 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFix") returned 0x75c14f50 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarInt") returned 0x75c15100 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNeg") returned 0x75c152c0 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNot") returned 0x75c16560 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarRound") returned 0x75c154f0 [0036.446] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCmp") returned 0x75bd60b0 [0036.447] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecAdd") returned 0x75beb090 [0036.447] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecCmp") returned 0x75beb870 [0036.447] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrCat") returned 0x75bd6fc0 [0036.447] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCyMulI4") returned 0x75beaac0 [0036.447] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrCmp") returned 0x75bd6590 [0036.447] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x77920000 [0036.447] GetProcAddress (hModule=0x77920000, lpProcName="CoCreateInstanceEx") returned 0x75d62d10 [0036.447] GetProcAddress (hModule=0x77920000, lpProcName="CLSIDFromProgIDEx") returned 0x75d55cf0 [0036.447] GetSystemMetrics (nIndex=42) returned 0 [0036.447] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e688 | out: ppMalloc=0x6610e688*=0x75e4d000) returned 0x0 [0036.448] IMalloc:Alloc (This=0x75e4d000, cb=0x4) returned 0x685cf8 [0036.448] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f960, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0036.448] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", lpString2=".cfg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe.cfg") returned="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe.cfg" [0036.448] SetLastError (dwErrCode=0x0) [0036.448] SearchPathA (in: lpPath=0x0, lpFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x19f85c, lpFilePart=0x19f830 | out: lpBuffer="", lpFilePart=0x19f830*="\x8bÿU\x8bì\x83ì\x1cS\x8b]\x0cVWÆEÿ") returned 0x0 [0036.449] SetLastError (dwErrCode=0x2) [0036.449] GetLastError () returned 0x2 [0036.449] lstrcmpiA (lpString1="GASAS", lpString2="MTX") returned -1 [0036.450] lstrcmpiA (lpString1="GASAS", lpString2="DLLHOST") returned 1 [0036.450] lstrcmpiA (lpString1="GASAS", lpString2="INETINFO") returned -1 [0036.450] lstrcmpiA (lpString1="GASAS", lpString2="W3WP") returned -1 [0036.450] lstrcmpiA (lpString1="GASAS", lpString2="ASPNET_WP") returned 1 [0036.450] lstrcmpiA (lpString1="GASAS", lpString2="DLLHST3G") returned 1 [0036.450] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f954, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0036.450] lstrcmpiA (lpString1="GASAS", lpString2="IEXPLORE") returned -1 [0036.450] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x74230000 [0036.678] GetLastError () returned 0x0 [0036.678] GetProcAddress (hModule=0x74230000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x74299bc0 [0036.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fea4, cbMultiByte=-1, lpWideCharStr=0x19fea0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0036.678] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x1c) returned 0x1f71e28 [0036.678] CoRegisterMessageFilter (in: lpMessageFilter=0x1f71e2c, lplpMessageFilter=0x1f71e34 | out: lplpMessageFilter=0x1f71e34*=0x0) returned 0x0 [0036.678] IUnknown:AddRef (This=0x1f71e2c) returned 0x2 [0036.679] GetClassInfoExA (in: hInstance=0x66000000, lpszClass="ThunderRT6Main", lpwcx=0x19fe70 | out: lpwcx=0x19fe70) returned 0 [0036.679] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x70083 [0036.681] GetModuleHandleA (lpModuleName="USER32") returned 0x74b70000 [0036.682] GetProcAddress (hModule=0x74b70000, lpProcName="GetSystemMetrics") returned 0x74b9ddc0 [0036.682] GetProcAddress (hModule=0x74b70000, lpProcName="MonitorFromWindow") returned 0x74b85c10 [0036.682] GetProcAddress (hModule=0x74b70000, lpProcName="MonitorFromRect") returned 0x74b85820 [0036.682] GetProcAddress (hModule=0x74b70000, lpProcName="MonitorFromPoint") returned 0x74b86810 [0036.682] GetProcAddress (hModule=0x74b70000, lpProcName="EnumDisplayMonitors") returned 0x74ba32e0 [0036.682] GetProcAddress (hModule=0x74b70000, lpProcName="GetMonitorInfoA") returned 0x74b9df30 [0036.682] GetSystemMetrics (nIndex=0) returned 1440 [0036.682] GetSystemMetrics (nIndex=78) returned 1440 [0036.682] GetSystemMetrics (nIndex=1) returned 900 [0036.682] GetSystemMetrics (nIndex=79) returned 900 [0036.682] GetSystemMetrics (nIndex=50) returned 16 [0036.682] GetSystemMetrics (nIndex=49) returned 16 [0036.682] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x1f0137 [0036.684] RegisterClassExA (param_1=0x19fe70) returned 0xc170 [0036.684] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x60030 [0037.044] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x81, wParam=0x0, lParam=0x19f9e0) returned 0x1 [0037.049] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x83, wParam=0x0, lParam=0x19f9cc) returned 0x0 [0037.050] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x1, wParam=0x0, lParam=0x19f9e0) returned 0x0 [0037.050] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0037.050] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0037.050] MonitorFromWindow (hwnd=0x60030, dwFlags=0x2) returned 0x10001 [0037.050] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x19fe78 | out: lpmi=0x19fe78) returned 1 [0037.050] SetWindowPos (hWnd=0x60030, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0037.050] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x46, wParam=0x0, lParam=0x19fe1c) returned 0x0 [0037.052] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x47, wParam=0x0, lParam=0x19fe1c) returned 0x0 [0037.052] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0037.052] ShowWindow (hWnd=0x60030, nCmdShow=4) returned 0 [0037.053] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0037.053] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x46, wParam=0x0, lParam=0x19fe2c) returned 0x0 [0037.059] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x47, wParam=0x0, lParam=0x19fe2c) returned 0x0 [0037.059] GetWindowThreadProcessId (in: hWnd=0x60030, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x47c [0037.059] VirtualQuery (in: lpAddress=0x19fea0, lpBuffer=0x19fe84, dwLength=0x1c | out: lpBuffer=0x19fe84*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.059] GetUserDefaultLCID () returned 0x409 [0037.059] IsValidCodePage (CodePage=0x3a4) returned 1 [0037.060] IsValidCodePage (CodePage=0x3b5) returned 1 [0037.060] IsValidCodePage (CodePage=0x3b6) returned 1 [0037.061] IsValidCodePage (CodePage=0x3a8) returned 1 [0037.068] GetUserDefaultLangID () returned 0x409 [0037.068] GetSystemDefaultLangID () returned 0x680409 [0037.068] GetSystemMetrics (nIndex=42) returned 0 [0037.068] IMalloc:Alloc (This=0x75e4d000, cb=0xa8) returned 0x6801b0 [0037.068] IMalloc:GetSize (This=0x75e4d000, pv=0x6801b0) returned 0xa8 [0037.068] IMalloc:Alloc (This=0x75e4d000, cb=0xc) returned 0x691d00 [0037.068] GetCurrentThreadId () returned 0x47c [0037.068] IMalloc:Alloc (This=0x75e4d000, cb=0x3c) returned 0x67e510 [0037.068] IMalloc:Alloc (This=0x75e4d000, cb=0x1c) returned 0x6976a0 [0037.069] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x19fe6c | out: phkResult=0x19fe6c*=0x0) returned 0x2 [0037.069] IMalloc:Alloc (This=0x75e4d000, cb=0x1c) returned 0x6975d8 [0037.069] GetCurrentThreadId () returned 0x47c [0037.069] SetWindowsHookExA (idHook=-1, lpfn=0x66061e09, hmod=0x0, dwThreadId=0x47c) returned 0x9022d [0037.070] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x14) returned 0x1f71e50 [0037.070] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x80) returned 0x1f71e70 [0037.070] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x10) returned 0x1f71ef8 [0037.070] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x2c) returned 0x1f71f10 [0037.070] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x19fdc4 | out: lpWndClass=0x19fdc4) returned 0 [0037.070] RegisterClassA (lpWndClass=0x19fdc4) returned 0xc171 [0037.070] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x8004a [0037.070] NtdllDefWindowProc_A (hWnd=0x8004a, Msg=0x81, wParam=0x0, lParam=0x19f990) returned 0x1 [0037.071] NtdllDefWindowProc_A (hWnd=0x8004a, Msg=0x83, wParam=0x0, lParam=0x19f97c) returned 0x0 [0037.071] NtdllDefWindowProc_A (hWnd=0x8004a, Msg=0x1, wParam=0x0, lParam=0x19f990) returned 0x0 [0037.071] NtdllDefWindowProc_A (hWnd=0x8004a, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0037.071] NtdllDefWindowProc_A (hWnd=0x8004a, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0037.073] SetWindowLongA (hWnd=0x8004a, nIndex=0, dwNewLong=32972404) returned 0 [0037.073] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x38) returned 0x1f71f48 [0037.073] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x18) returned 0x1f71f88 [0037.073] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x10) returned 0x1f71fa8 [0037.074] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0037.074] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0037.074] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0037.074] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0037.074] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0037.074] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0037.074] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0037.074] CreateCompatibleDC (hdc=0x0) returned 0xbb01019f [0037.074] GetCurrentObject (hdc=0xbb01019f, type=0x7) returned 0x85000f [0037.074] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x60030, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x60044 [0037.074] NtdllDefWindowProc_A (hWnd=0x60044, Msg=0x81, wParam=0x0, lParam=0x19fa20) returned 0x1 [0037.075] NtdllDefWindowProc_A (hWnd=0x60044, Msg=0x83, wParam=0x0, lParam=0x19fa0c) returned 0x0 [0037.075] NtdllDefWindowProc_A (hWnd=0x60044, Msg=0x1, wParam=0x0, lParam=0x19fa20) returned 0x0 [0037.075] NtdllDefWindowProc_A (hWnd=0x60044, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0037.075] NtdllDefWindowProc_A (hWnd=0x60044, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0037.075] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0x210, wParam=0x1, lParam=0x60044) returned 0x0 [0037.075] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x18) returned 0x1f71fc0 [0037.076] RtlAllocateHeap (HeapHandle=0x27d0000, Flags=0x8, Size=0x114) returned 0x27d05a8 [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x5c) returned 0x1f71fe8 [0037.076] GetCurrentThreadId () returned 0x47c [0037.076] GetCurrentThreadId () returned 0x47c [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x10) returned 0x1f72050 [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x30) returned 0x1f72068 [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x434) returned 0x1f720a0 [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x434) returned 0x1f724e0 [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x3c) returned 0x1f72920 [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f72968 [0037.076] lstrlenA (lpString="VB") returned 2 [0037.076] lstrlenA (lpString="CommandButton") returned 13 [0037.076] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x11) returned 0x1f72a88 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f72aa8 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xd4) returned 0x1f72ad8 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x44) returned 0x1f72bb8 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1c8) returned 0x1f72c08 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x28) returned 0x1f72dd8 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f72e08 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x28) returned 0x1f72e28 [0037.077] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f72e58 [0037.078] lstrlenA (lpString="VB") returned 2 [0037.078] lstrlenA (lpString="OptionButton") returned 12 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x10) returned 0x1f72f78 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f72f90 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xd4) returned 0x1f72fc0 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x4c) returned 0x1f730a0 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1c8) returned 0x1f730f8 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f732c8 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f732e8 [0037.078] lstrlenA (lpString="VB") returned 2 [0037.078] lstrlenA (lpString="ComboBox") returned 8 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xc) returned 0x1f73408 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x108) returned 0x1f73420 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x4c) returned 0x1f73530 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x230) returned 0x1f73588 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f737c0 [0037.078] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f737e0 [0037.078] lstrlenA (lpString="VB") returned 2 [0037.079] lstrlenA (lpString="Timer") returned 5 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x9) returned 0x1f73900 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xc) returned 0x1f73918 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x30) returned 0x1f73930 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x4) returned 0x1f73968 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x9c) returned 0x1f73978 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f73a20 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f73a40 [0037.079] lstrlenA (lpString="VB") returned 2 [0037.079] lstrlenA (lpString="Printer") returned 7 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xb) returned 0x1f73b60 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xdc) returned 0x1f73b78 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f73c60 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f73c80 [0037.079] lstrlenA (lpString="VB") returned 2 [0037.079] lstrlenA (lpString="Form") returned 4 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x8) returned 0x1f73da0 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x184) returned 0x1f73db0 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x7c) returned 0x1f73f40 [0037.079] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x2f8) returned 0x1f73fc8 [0037.080] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f72dd8, Size=0x50) returned 0x1f742c8 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f72dd8 [0037.080] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f72e28, Size=0x50) returned 0x1f74320 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f74378 [0037.080] lstrlenA (lpString="VB") returned 2 [0037.080] lstrlenA (lpString="Screen") returned 6 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xa) returned 0x1f72e28 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x2c) returned 0x1f74498 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xa0) returned 0x1f744d0 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f74578 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f74598 [0037.080] lstrlenA (lpString="VB") returned 2 [0037.080] lstrlenA (lpString="Clipboard") returned 9 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xd) returned 0x1f72e40 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x1c) returned 0x1f746b8 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x68) returned 0x1f746e0 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f74750 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f74770 [0037.080] lstrlenA (lpString="VB") returned 2 [0037.080] lstrlenA (lpString="MDIForm") returned 7 [0037.080] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xb) returned 0x1f74890 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x184) returned 0x1f748a8 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x7c) returned 0x1f74a38 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x2f8) returned 0x1f74ac0 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f74dc0 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f74de0 [0037.081] lstrlenA (lpString="VB") returned 2 [0037.081] lstrlenA (lpString="App") returned 3 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x7) returned 0x1f72df8 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x84) returned 0x1f74f00 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x148) returned 0x1f74f90 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f750e0 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f75100 [0037.081] lstrlenA (lpString="VB") returned 2 [0037.081] lstrlenA (lpString="Shape") returned 5 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x9) returned 0x1f75220 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x1c) returned 0x1f75238 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x68) returned 0x1f75260 [0037.081] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xfc) returned 0x1f752d0 [0037.081] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f742c8, Size=0x78) returned 0x1f753d8 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f742c8 [0037.082] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f74320, Size=0x78) returned 0x1f75458 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f754d8 [0037.082] lstrlenA (lpString="VB") returned 2 [0037.082] lstrlenA (lpString="Data") returned 4 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x8) returned 0x1f742e8 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xd8) returned 0x1f755f8 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x3c) returned 0x1f742f8 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1d8) returned 0x1f756d8 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f74340 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f758b8 [0037.082] lstrlenA (lpString="VB") returned 2 [0037.082] lstrlenA (lpString="UserControl") returned 11 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xf) returned 0x1f74360 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x1e4) returned 0x1f759d8 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xb0) returned 0x1f75bc8 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x3a4) returned 0x1f75c80 [0037.082] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f76030 [0037.083] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f78f80 [0037.083] lstrlenA (lpString="VB") returned 2 [0037.083] lstrlenA (lpString="PropertyPage") returned 12 [0037.083] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x10) returned 0x1f704a0 [0037.083] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x190) returned 0x1f790a0 [0037.083] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x88) returned 0x1f704b8 [0037.083] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x310) returned 0x1f79238 [0037.083] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0037.083] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f70548 [0037.084] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f79550 [0037.084] lstrlenA (lpString="VB") returned 2 [0037.084] lstrlenA (lpString="UserDocument") returned 12 [0037.084] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x10) returned 0x1f70568 [0037.084] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x1c8) returned 0x1f79670 [0037.084] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xa8) returned 0x1f79840 [0037.084] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x370) returned 0x1f798f0 [0037.084] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79cb0 [0037.084] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x20) returned 0x1f70580 [0037.085] RtlAllocateHeap (HeapHandle=0x27d0000, Flags=0x8, Size=0x30) returned 0x27d06c8 [0037.085] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xa0) returned 0x1f7a470 [0037.085] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7a518 [0037.085] GetCurrentThreadId () returned 0x47c [0037.085] GetCurrentThreadId () returned 0x47c [0037.085] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x10) returned 0x1f7a548 [0037.086] RtlAllocateHeap (HeapHandle=0x27d0000, Flags=0x8, Size=0x30) returned 0x27d0700 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xa0) returned 0x1f7a560 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7a608 [0037.086] GetCurrentThreadId () returned 0x47c [0037.086] GetCurrentThreadId () returned 0x47c [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x10) returned 0x1f7a638 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7a650 [0037.086] lstrlenA (lpString="VB") returned 2 [0037.086] lstrlenA (lpString="PictureBox") returned 10 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xe) returned 0x1f7a960 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x16c) returned 0x1f7a978 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x68) returned 0x1f7aaf0 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x2c8) returned 0x1f7ab60 [0037.086] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f753d8, Size=0xa0) returned 0x1f7ae30 [0037.086] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f7a010 [0037.087] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f75458, Size=0xa0) returned 0x1f7aed8 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7af80 [0037.087] lstrlenA (lpString="VB") returned 2 [0037.087] lstrlenA (lpString="Label") returned 5 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x9) returned 0x1f7a7f8 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x34) returned 0x1f753d8 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xf0) returned 0x1f7b0a0 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x48) returned 0x1f75418 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1f4) returned 0x1f7b198 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79e90 [0037.087] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7b610 [0037.088] lstrlenA (lpString="VB") returned 2 [0037.088] lstrlenA (lpString="TextBox") returned 7 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xb) returned 0x1f7a948 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x38) returned 0x1f75468 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x120) returned 0x1f7c3a0 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x60) returned 0x1f7c4c8 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x250) returned 0x1f7c530 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79ff0 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7bf50 [0037.088] lstrlenA (lpString="VB") returned 2 [0037.088] lstrlenA (lpString="Frame") returned 5 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x9) returned 0x1f7a798 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x24) returned 0x1f754a8 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xb0) returned 0x1f7c788 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x34) returned 0x1f7c840 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x184) returned 0x1f7c880 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79f70 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7b4e8 [0037.088] lstrlenA (lpString="VB") returned 2 [0037.088] lstrlenA (lpString="CheckBox") returned 8 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xc) returned 0x1f7a8b8 [0037.088] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7ca10 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xec) returned 0x1f7ca40 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x48) returned 0x1f7cb38 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1f8) returned 0x1f7cb88 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79d10 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7c1a0 [0037.089] lstrlenA (lpString="VB") returned 2 [0037.089] lstrlenA (lpString="ListBox") returned 7 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xb) returned 0x1f7a7b0 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x108) returned 0x1f7cd88 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x54) returned 0x1f7ce98 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x230) returned 0x1f7cef8 [0037.089] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f7ae30, Size=0xc8) returned 0x1f7d130 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f7a050 [0037.089] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f7aed8, Size=0xc8) returned 0x1f7d200 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7b738 [0037.089] lstrlenA (lpString="VB") returned 2 [0037.089] lstrlenA (lpString="HScrollBar") returned 10 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xe) returned 0x1f7a7c8 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x24) returned 0x1f7ae30 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x90) returned 0x1f7ae60 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7aef8 [0037.089] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x144) returned 0x1f7d2d0 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f7a030 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7b3c0 [0037.090] lstrlenA (lpString="VB") returned 2 [0037.090] lstrlenA (lpString="VScrollBar") returned 10 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xe) returned 0x1f7a7e0 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x24) returned 0x1f7af28 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x90) returned 0x1f7d420 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7d4b8 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x144) returned 0x1f7d4e8 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79ef0 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7b860 [0037.090] lstrlenA (lpString="VB") returned 2 [0037.090] lstrlenA (lpString="DriveListBox") returned 12 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x10) returned 0x1f7a810 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7d638 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xc0) returned 0x1f7d668 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x40) returned 0x1f7d730 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1a0) returned 0x1f7d778 [0037.090] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79d90 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7bd00 [0037.091] lstrlenA (lpString="VB") returned 2 [0037.091] lstrlenA (lpString="DirListBox") returned 10 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xe) returned 0x1f7a828 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7d920 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xc8) returned 0x1f7d950 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x50) returned 0x1f7da20 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1b0) returned 0x1f7da78 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79e10 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7be28 [0037.091] lstrlenA (lpString="VB") returned 2 [0037.091] lstrlenA (lpString="FileListBox") returned 11 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xf) returned 0x1f7a858 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x28) returned 0x1f7dc30 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xec) returned 0x1f7dc60 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x58) returned 0x1f7dd58 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1f8) returned 0x1f7ddb8 [0037.091] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f7d130, Size=0xf0) returned 0x1f7dfb8 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79d30 [0037.091] RtlReAllocateHeap (Heap=0x1f70000, Flags=0x0, Ptr=0x1f7d200, Size=0xf0) returned 0x1f7e0b0 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7b988 [0037.091] lstrlenA (lpString="VB") returned 2 [0037.091] lstrlenA (lpString="Menu") returned 4 [0037.091] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x8) returned 0x1f7af58 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x38) returned 0x1f7d130 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x4) returned 0x1f7af68 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xb8) returned 0x1f7d170 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79eb0 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7c078 [0037.092] lstrlenA (lpString="VB") returned 2 [0037.092] lstrlenA (lpString="Line") returned 4 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x8) returned 0x1f7d230 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x18) returned 0x1f79d70 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x50) returned 0x1f7d240 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xd0) returned 0x1f7e1a8 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79d50 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7bab0 [0037.092] lstrlenA (lpString="VB") returned 2 [0037.092] lstrlenA (lpString="Image") returned 5 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x9) returned 0x1f7a840 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x24) returned 0x1f7d298 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x98) returned 0x1f7e280 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x34) returned 0x1f7e320 [0037.092] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x154) returned 0x1f7e360 [0037.093] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79dd0 [0037.093] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x114) returned 0x1f7bbd8 [0037.093] lstrlenA (lpString="VB") returned 2 [0037.093] lstrlenA (lpString="OLE") returned 3 [0037.093] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x7) returned 0x1f7e4c0 [0037.093] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x17c) returned 0x1f7e4d0 [0037.093] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x40) returned 0x1f7e658 [0037.093] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x2f0) returned 0x1f7e6a0 [0037.093] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79f90 [0037.106] IMalloc:Alloc (This=0x75e4d000, cb=0x64) returned 0x67f338 [0037.107] IMalloc:Alloc (This=0x75e4d000, cb=0x64) returned 0x67ebd0 [0037.107] IMalloc:Alloc (This=0x75e4d000, cb=0xc) returned 0x691f10 [0037.107] IMalloc:Alloc (This=0x75e4d000, cb=0x40) returned 0x681a30 [0037.107] IMalloc:GetSize (This=0x75e4d000, pv=0x681a30) returned 0x40 [0037.107] IMalloc:Alloc (This=0x75e4d000, cb=0x20) returned 0x6976f0 [0037.107] GetCurrentThreadId () returned 0x47c [0037.107] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x54) returned 0x1f7e998 [0037.107] GetCurrentThreadId () returned 0x47c [0037.107] IMalloc:Alloc (This=0x75e4d000, cb=0x1c) returned 0x6976c8 [0037.107] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x104) returned 0x1f7e9f8 [0037.107] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x6f8) returned 0x28b0048 [0037.108] VirtualProtect (in: lpAddress=0x1f20000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x19fdf0 | out: lpflOldProtect=0x19fdf0*=0x20) returned 1 [0037.108] GetCurrentProcess () returned 0xffffffff [0037.108] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1f20000, dwSize=0x6000) returned 1 [0037.108] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0037.108] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0037.108] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xd4) returned 0x1f7eb08 [0037.108] VirtualAlloc (lpAddress=0x1f20000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0037.109] VirtualAlloc (lpAddress=0x1f20000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f20000 [0037.109] VirtualProtect (in: lpAddress=0x1f20000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x19fdf0 | out: lpflOldProtect=0x19fdf0*=0x4) returned 1 [0037.110] GetCurrentProcess () returned 0xffffffff [0037.110] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1f20000, dwSize=0xa000) returned 1 [0037.110] GetCurrentThreadId () returned 0x47c [0037.110] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x23ec) returned 0x28b0748 [0037.119] GetCurrentThreadId () returned 0x47c [0037.119] SetWindowTextA (hWnd=0x60030, lpString="AMMIccova") returned 1 [0037.119] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0xc, wParam=0x0, lParam=0x19fd64) returned 0x1 [0037.120] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x19fd4c | out: phkResult=0x19fd4c*=0x0) returned 0x2 [0037.121] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0037.121] VirtualQuery (in: lpAddress=0x19f778, lpBuffer=0x19f75c, dwLength=0x1c | out: lpBuffer=0x19f75c*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0037.122] IMalloc:Alloc (This=0x75e4d000, cb=0x70) returned 0x6811e0 [0037.122] IMalloc:GetSize (This=0x75e4d000, pv=0x6811e0) returned 0x70 [0037.123] GetCurrentThreadId () returned 0x47c [0037.123] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x104) returned 0x1f7ebe8 [0037.123] GetCurrentThreadId () returned 0x47c [0037.123] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x1e4) returned 0x1f7ecf8 [0037.123] GetCurrentThreadId () returned 0x47c [0037.126] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.126] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.127] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.127] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.127] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.127] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\Qq8qgKOGJS647hpO52iTYfl2VuxTiMIviymZS1Bv239\\U30031", phkResult=0x19f634 | out: phkResult=0x19f634*=0x188) returned 0x0 [0037.128] RegSetValueExW (in: hKey=0x188, lpValueName="mtJmC38VTGaknjdtgXFivhKaQE254", Reserved=0x0, dwType=0x1, lpData="aUzRm9ANNmLdZLT142", cbData=0x26 | out: lpData="aUzRm9ANNmLdZLT142") returned 0x0 [0037.128] RegCloseKey (hKey=0x188) returned 0x0 [0037.128] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\XDGbUtcIkuCnSu29IJe2TXzfQCeyhqEYe7188\\XBFHlTPtCBfKqs9UwI2zObKfEsV5hgA4Hh5dy6", phkResult=0x19f634 | out: phkResult=0x19f634*=0x184) returned 0x0 [0037.129] RegSetValueExW (in: hKey=0x184, lpValueName="D9fKO4rBg0Xe00yWzx64", Reserved=0x0, dwType=0x1, lpData="cJvoQ8rudn14FAVZhSWGhU20GSLamAK76RyVc208", cbData=0x52 | out: lpData="cJvoQ8rudn14FAVZhSWGhU20GSLamAK76RyVc208") returned 0x0 [0037.129] RegCloseKey (hKey=0x184) returned 0x0 [0037.129] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\hEDo8dNvhHUQvueTszwLUnVhm248\\ihlxxKCSc114", phkResult=0x19f634 | out: phkResult=0x19f634*=0x188) returned 0x0 [0037.129] RegSetValueExW (in: hKey=0x188, lpValueName="Cxx6Y7Zs3GcpIoe5D4bvOsoWuJVA8gb161", Reserved=0x0, dwType=0x1, lpData="seNnXHIR5TGAl5rAFiqWYEV4XMxteFUyE132", cbData=0x4a | out: lpData="seNnXHIR5TGAl5rAFiqWYEV4XMxteFUyE132") returned 0x0 [0037.129] RegCloseKey (hKey=0x188) returned 0x0 [0037.129] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\Te3ta8i8q1Yjl4yyWE4xFCZE233\\P2FE5QM162", phkResult=0x19f634 | out: phkResult=0x19f634*=0x184) returned 0x0 [0037.130] RegSetValueExW (in: hKey=0x184, lpValueName="xBpB7s179", Reserved=0x0, dwType=0x1, lpData="HkDATmWDXM5h8bkqer8AlBoPN245jO1HwnZ245", cbData=0x4e | out: lpData="HkDATmWDXM5h8bkqer8AlBoPN245jO1HwnZ245") returned 0x0 [0037.130] RegCloseKey (hKey=0x184) returned 0x0 [0037.130] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\bxhZLGpbIzTFIo67mIxT7vkltx9kr7eXfRHCiWcf176\\a8OJ1cZl0362", phkResult=0x19f634 | out: phkResult=0x19f634*=0x188) returned 0x0 [0037.130] RegSetValueExW (in: hKey=0x188, lpValueName="G8ocOUVksYXSbZwykiJNccGaAHsfoluxGm8LK5127", Reserved=0x0, dwType=0x1, lpData="hjm06lZ75", cbData=0x14 | out: lpData="hjm06lZ75") returned 0x0 [0037.130] RegCloseKey (hKey=0x188) returned 0x0 [0037.130] VarCmp (pvarLeft=0x19f808, pvarRight=0x19f7b8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.130] GetUserDefaultLCID () returned 0x409 [0037.131] SafeArrayCopy (in: psa=0x6845e0, ppsaOut=0x19f86c | out: ppsaOut=0x19f86c) returned 0x0 [0037.131] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.131] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.132] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.132] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.132] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.132] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.132] GetUserDefaultLCID () returned 0x409 [0037.132] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0037.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x691dac, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0037.133] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.133] GetUserDefaultLCID () returned 0x409 [0037.133] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0037.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x691dac, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0037.133] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.133] GetUserDefaultLCID () returned 0x409 [0037.133] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0037.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x691dac, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0037.133] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.133] GetUserDefaultLCID () returned 0x409 [0037.133] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0037.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x691dac, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0037.133] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.133] GetUserDefaultLCID () returned 0x409 [0037.133] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0037.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x691dac, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0037.133] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.134] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.134] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.134] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.134] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.135] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.136] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0xfc) returned 0x28b2b40 [0037.136] GetVersionExA (in: lpVersionInformation=0x19f4c0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x3f4, dwMinorVersion=0x190ba8b, dwBuildNumber=0x1f700c0, dwPlatformId=0x0, szCSDVersion="0ù\x19") | out: lpVersionInformation=0x19f4c0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0037.136] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0037.136] GetCurrentThreadId () returned 0x47c [0037.136] GetCurrentThreadId () returned 0x47c [0037.136] GetCurrentThreadId () returned 0x47c [0037.136] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xa) returned 0x1f7a870 [0037.136] SetWindowTextA (hWnd=0x60030, lpString="AMMIccova") returned 1 [0037.136] NtdllDefWindowProc_A (hWnd=0x60030, Msg=0xc, wParam=0x0, lParam=0x1f7a870) returned 0x1 [0037.137] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1) returned 0x1f7eee8 [0037.137] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xa) returned 0x1f7a888 [0037.137] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0xa) returned 0x1f7a918 [0037.137] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x8, Size=0x15) returned 0x1f79e50 [0037.138] LoadLibraryA (lpLibFileName="VERSION.DLL") returned 0x74220000 [0037.242] GetLastError () returned 0x0 [0037.242] GetProcAddress (hModule=0x74220000, lpProcName="VerQueryValueA") returned 0x742214f0 [0037.242] GetProcAddress (hModule=0x74220000, lpProcName="GetFileVersionInfoSizeA") returned 0x742214d0 [0037.242] GetProcAddress (hModule=0x74220000, lpProcName="GetFileVersionInfoA") returned 0x742214b0 [0037.242] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f46c, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0037.242] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", lpdwHandle=0x19f5ac | out: lpdwHandle=0x19f5ac) returned 0x4e4 [0037.242] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x4e4) returned 0x28b2c48 [0037.242] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwHandle=0x0, dwLen=0x4e4, lpData=0x28b2c48 | out: lpData=0x28b2c48) returned 1 [0037.242] VerQueryValueA (in: pBlock=0x28b2c48, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f5a4, puLen=0x19f5b4 | out: lplpBuffer=0x19f5a4*=0x28b2ce4, puLen=0x19f5b4) returned 1 [0037.242] wsprintfA (in: param_1=0x19f570, param_2="\\StringFileInfo\\%04x%04x\\%s" | out: param_1="\\StringFileInfo\\040904b0\\LegalTrademarks") returned 40 [0037.242] VerQueryValueA (in: pBlock=0x28b2c48, lpSubBlock="\\StringFileInfo\\040904b0\\LegalTrademarks", lplpBuffer=0x19f5a8, puLen=0x19f5b4 | out: lplpBuffer=0x19f5a8*=0x19f5d4, puLen=0x19f5b4) returned 0 [0037.243] HeapFree (in: hHeap=0x1f70000, dwFlags=0x0, lpMem=0x28b2c48 | out: hHeap=0x1f70000) returned 1 [0037.243] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x1) returned 0x1f7eef8 [0037.243] HeapFree (in: hHeap=0x1f70000, dwFlags=0x0, lpMem=0x1f7eef8 | out: hHeap=0x1f70000) returned 1 [0037.244] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0037.245] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.245] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0037.245] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.245] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0037.245] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.245] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0037.245] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.245] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0037.245] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0037.245] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f4ac, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0037.246] lstrcpynA (in: lpString1=0x19f398, lpString2="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", iMaxLength=260 | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe") returned="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" [0037.246] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe") returned 33 [0037.246] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x22) returned 0x1f7eef8 [0037.246] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x22) returned 0x1f7ef28 [0037.246] lstrcpyA (in: lpString1=0x1f7eef8, lpString2="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe") returned="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" [0037.247] RtlAllocateHeap (HeapHandle=0x1f70000, Flags=0x0, Size=0x6) returned 0x1f7ef58 [0037.247] HeapFree (in: hHeap=0x1f70000, dwFlags=0x0, lpMem=0x1f7ef28 | out: hHeap=0x1f70000) returned 1 [0037.247] HeapFree (in: hHeap=0x1f70000, dwFlags=0x0, lpMem=0x1f7eef8 | out: hHeap=0x1f70000) returned 1 [0037.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f7ef58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0037.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1f7ef58, cbMultiByte=-1, lpWideCharStr=0x697654, cchWideChar=6 | out: lpWideCharStr="GASAS") returned 6 [0037.247] HeapFree (in: hHeap=0x1f70000, dwFlags=0x0, lpMem=0x1f7ef58 | out: hHeap=0x1f70000) returned 1 [0037.247] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\GASAS\\BLOCKHgareth", phkResult=0x19f628 | out: phkResult=0x19f628*=0x0) returned 0x2 [0037.247] RegCloseKey (hKey=0x0) returned 0x6 [0037.248] SafeArrayCopy (in: psa=0x6845e0, ppsaOut=0x19f8b8 | out: ppsaOut=0x19f8b8) returned 0x0 [0037.248] GetUserDefaultLCID () returned 0x409 [0037.248] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0037.248] GetUserDefaultLCID () returned 0x409 [0037.248] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0037.248] GetUserDefaultLCID () returned 0x409 [0037.248] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0037.248] GetUserDefaultLCID () returned 0x409 [0037.248] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0037.248] GetUserDefaultLCID () returned 0x409 [0037.248] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0037.270] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x40) returned 0x1f50000 [0038.357] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.357] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0038.357] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.357] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0038.357] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.357] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0038.357] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.357] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0038.357] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.358] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0038.358] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.358] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0038.358] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.358] LoadLibraryA (lpLibFileName="user32") returned 0x74b70000 [0038.358] SetErrorMode (uMode=0x8001) returned 0x8001 [0038.358] GetProcAddress (hModule=0x74b70000, lpProcName="EnumWindows") returned 0x74b8a3c0 [0038.358] EnumWindows (lpEnumFunc=0x1f5043e, lParam=0x19f648) returned 1 [0038.360] GetTickCount () returned 0x114a2b9 [0038.360] Sleep (dwMilliseconds=0x7d0) [0040.511] GetTickCount () returned 0x114ab26 [0040.511] SetErrorMode (uMode=0x8001) returned 0x8001 [0040.511] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0040.511] SetErrorMode (uMode=0x8001) returned 0x8001 [0040.511] GetProcAddress (hModule=0x75e90000, lpProcName="SetErrorMode") returned 0x75ea6500 [0040.511] SetErrorMode (uMode=0x800) returned 0x8001 [0040.511] SetErrorMode (uMode=0x0) returned 0x800 [0040.511] SetErrorMode (uMode=0x8001) returned 0x0 [0040.511] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0040.511] SetErrorMode (uMode=0x0) returned 0x8001 [0040.511] GetProcAddress (hModule=0x75e90000, lpProcName="SetLastError") returned 0x75ea4f00 [0040.511] SetLastError (dwErrCode=0x5) [0040.511] SetErrorMode (uMode=0x8001) returned 0x0 [0040.512] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0040.512] SetErrorMode (uMode=0x0) returned 0x8001 [0040.512] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0040.512] SetErrorMode (uMode=0x8001) returned 0x0 [0040.512] LoadLibraryA (lpLibFileName="shell32") returned 0x76480000 [0045.340] SetErrorMode (uMode=0x0) returned 0x8001 [0045.340] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteW") returned 0x765e42e0 [0045.340] SetErrorMode (uMode=0x8001) returned 0x0 [0045.340] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.340] SetErrorMode (uMode=0x0) returned 0x8001 [0045.340] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0045.340] SetErrorMode (uMode=0x8001) returned 0x0 [0045.340] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.340] SetErrorMode (uMode=0x0) returned 0x8001 [0045.340] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0045.340] SetErrorMode (uMode=0x8001) returned 0x0 [0045.340] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.340] SetErrorMode (uMode=0x0) returned 0x8001 [0045.341] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtectEx") returned 0x75ea6a50 [0045.341] SetErrorMode (uMode=0x8001) returned 0x0 [0045.341] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.341] SetErrorMode (uMode=0x0) returned 0x8001 [0045.341] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessInternalW") returned 0x75ea45f0 [0045.341] SetErrorMode (uMode=0x8001) returned 0x0 [0045.341] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.341] SetErrorMode (uMode=0x0) returned 0x8001 [0045.341] GetProcAddress (hModule=0x75e90000, lpProcName="GetTempPathW") returned 0x75efeff0 [0045.341] SetErrorMode (uMode=0x8001) returned 0x0 [0045.341] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.341] SetErrorMode (uMode=0x0) returned 0x8001 [0045.341] GetProcAddress (hModule=0x75e90000, lpProcName="GetLongPathNameW") returned 0x75ed1710 [0045.341] SetErrorMode (uMode=0x8001) returned 0x0 [0045.341] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.341] SetErrorMode (uMode=0x0) returned 0x8001 [0045.342] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSize") returned 0x75efef30 [0045.342] SetErrorMode (uMode=0x8001) returned 0x0 [0045.342] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.342] SetErrorMode (uMode=0x0) returned 0x8001 [0045.342] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0045.342] SetErrorMode (uMode=0x8001) returned 0x0 [0045.342] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.342] SetErrorMode (uMode=0x0) returned 0x8001 [0045.342] GetProcAddress (hModule=0x75e90000, lpProcName="ExitThread") returned 0x77c16390 [0045.343] SetErrorMode (uMode=0x8001) returned 0x0 [0045.343] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0045.343] SetErrorMode (uMode=0x0) returned 0x8001 [0045.343] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0045.343] GetCurrentThread () returned 0xfffffffe [0045.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x1f5d093*=0x7ff931f41000, NumberOfBytesToProtect=0x1f5d08b, NewAccessProtection=0x40, OldAccessProtection=0x1f5d083 | out: BaseAddress=0x1f5d093*=0x7ff931f41000, NumberOfBytesToProtect=0x1f5d08b, OldAccessProtection=0x1f5d083*=0x20) returned 0x0 [0045.400] SetErrorMode (uMode=0x8001) returned 0x0 [0045.400] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0045.400] SetErrorMode (uMode=0x0) returned 0x8001 [0045.400] GetProcAddress (hModule=0x77bb0000, lpProcName="NtProtectVirtualMemory") returned 0x77c22210 [0045.402] SetErrorMode (uMode=0x8001) returned 0x0 [0045.402] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0045.402] SetErrorMode (uMode=0x0) returned 0x8001 [0045.402] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgBreakPoint") returned 0x77c23fb0 [0045.402] SetErrorMode (uMode=0x8001) returned 0x0 [0045.402] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0045.402] SetErrorMode (uMode=0x0) returned 0x8001 [0045.402] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgUiRemoteBreakin") returned 0x77c5a520 [0045.402] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, NewAccessProtection=0x40, OldAccessProtection=0x19f638 | out: BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, OldAccessProtection=0x19f638*=0x20) returned 0x0 [0045.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, NewAccessProtection=0x20, OldAccessProtection=0x19f638 | out: BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, OldAccessProtection=0x19f638*=0x80) returned 0x0 [0045.737] SetErrorMode (uMode=0x8001) returned 0x0 [0045.737] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0045.738] SetErrorMode (uMode=0x0) returned 0x8001 [0045.738] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetInformationThread") returned 0x77c21dc0 [0045.742] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0045.781] SetErrorMode (uMode=0x8001) returned 0x0 [0045.781] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0045.781] SetErrorMode (uMode=0x0) returned 0x8001 [0045.782] GetProcAddress (hModule=0x77bb0000, lpProcName="NtAllocateVirtualMemory") returned 0x77c21e70 [0045.787] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f9ac*=0x0, ZeroBits=0x0, RegionSize=0x19f9a8*=0x1c200000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19f9ac*=0x29b0000, RegionSize=0x19f9a8*=0x1c200000) returned 0x0 [0045.797] SetErrorMode (uMode=0x8001) returned 0x0 [0045.797] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0045.797] SetErrorMode (uMode=0x0) returned 0x8001 [0045.797] GetProcAddress (hModule=0x77bb0000, lpProcName="NtGetContextThread") returned 0x77c22ba0 [0045.797] SetErrorMode (uMode=0x8001) returned 0x0 [0045.797] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0045.798] SetErrorMode (uMode=0x0) returned 0x8001 [0045.798] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetContextThread") returned 0x77c234f0 [0045.804] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f9ac*=0x0, ZeroBits=0x0, RegionSize=0x19f9a8*=0x1d2c, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19f9ac*=0x1f60000, RegionSize=0x19f9a8*=0x2000) returned 0x0 [0045.846] SetErrorMode (uMode=0x8001) returned 0x0 [0045.846] LoadLibraryA (lpLibFileName="user32") returned 0x74b70000 [0045.846] SetErrorMode (uMode=0x0) returned 0x8001 [0045.846] GetProcAddress (hModule=0x74b70000, lpProcName="GetCursorPos") returned 0x74b8dcc0 [0045.851] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29b4004 | out: Context=0x29b4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0045.851] GetCursorPos (in: lpPoint=0x29b004c | out: lpPoint=0x29b004c*(x=1333, y=448)) returned 1 [0045.851] Sleep (dwMilliseconds=0x1) [0045.886] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29b4004 | out: Context=0x29b4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0045.886] GetCursorPos (in: lpPoint=0x29b004c | out: lpPoint=0x29b004c*(x=1333, y=448)) returned 1 [0045.887] Sleep (dwMilliseconds=0x1) [0045.927] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29b4004 | out: Context=0x29b4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0045.959] GetCursorPos (in: lpPoint=0x29b004c | out: lpPoint=0x29b004c*(x=1333, y=448)) returned 1 [0045.959] Sleep (dwMilliseconds=0x1) [0046.008] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29b4004 | out: Context=0x29b4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0046.009] GetCursorPos (in: lpPoint=0x29b004c | out: lpPoint=0x29b004c*(x=1333, y=448)) returned 1 [0046.013] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29b4004 | out: Context=0x29b4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0046.013] CreateProcessInternalW (in: hUserToken=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", lpCommandLine="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x29b0048*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x29b008c, hNewToken=0x0 | out: lpProcessInformation=0x29b008c*(hProcess=0x220, hThread=0x21c, dwProcessId=0x7fc, dwThreadId=0x270), hNewToken=0x0) returned 1 [0046.028] NtGetContextThread (in: ThreadHandle=0x21c, Context=0x29b009c | out: Context=0x29b009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x29c000, Edx=0x0, Ecx=0x0, Eax=0x401350, Ebp=0x0, Eip=0x77c24210, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0046.053] NtSetContextThread (ThreadHandle=0x21c, Context=0x29b009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x29c000, Edx=0x0, Ecx=0x0, Eax=0x47682a, Ebp=0x0, Eip=0x77c24210, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0046.093] SetErrorMode (uMode=0x8001) returned 0x0 [0046.093] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0046.093] SetErrorMode (uMode=0x0) returned 0x8001 [0046.093] GetProcAddress (hModule=0x77bb0000, lpProcName="NtResumeThread") returned 0x77c22230 [0046.098] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29b4004 | out: Context=0x29b4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0046.103] NtResumeThread (in: ThreadHandle=0x21c, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0046.165] SetErrorMode (uMode=0x8001) returned 0x0 [0046.165] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0046.165] SetErrorMode (uMode=0x0) returned 0x8001 [0046.165] GetProcAddress (hModule=0x75e90000, lpProcName="GetExitCodeProcess") returned 0x75ea3c60 [0046.165] GetExitCodeProcess (in: hProcess=0x220, lpExitCode=0x29b07fc | out: lpExitCode=0x29b07fc*=0x103) returned 1 [0046.167] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0x4bc Process: id = "2" image_name = "gasas.exe" filename = "c:\\users\\fd1hvy\\desktop\\gasas.exe" page_root = "0x1164a000" os_pid = "0x7fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x49c" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x270 [0046.382] GetVersion () returned 0x23f00206 [0046.383] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0046.383] GetProcAddress (hModule=0x75e90000, lpProcName="IsTNT") returned 0x0 [0046.383] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2110000 [0046.402] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x2120000 [0046.402] VirtualAlloc (lpAddress=0x2120000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2120000 [0046.404] GetCurrentThreadId () returned 0x270 [0046.404] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\" " [0046.404] GetEnvironmentStringsW () returned 0x5914d0* [0046.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0046.404] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x570) returned 0x21105a8 [0046.404] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x21105a8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0046.404] FreeEnvironmentStringsW (penv=0x5914d0) returned 1 [0046.404] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x0, Size=0x480) returned 0x2110b20 [0046.404] GetStartupInfoA (in: lpStartupInfo=0x19f8c4 | out: lpStartupInfo=0x19f8c4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0046.405] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0046.405] GetFileType (hFile=0x0) returned 0x0 [0046.405] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0046.405] GetFileType (hFile=0x0) returned 0x0 [0046.405] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0046.405] GetFileType (hFile=0x0) returned 0x0 [0046.405] SetHandleCount (uNumber=0x20) returned 0x20 [0046.405] GetACP () returned 0x4e4 [0046.405] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8ec | out: lpCPInfo=0x19f8ec) returned 1 [0046.405] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6610c528, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0046.406] HeapFree (in: hHeap=0x2110000, dwFlags=0x0, lpMem=0x21105a8 | out: hHeap=0x2110000) returned 1 [0046.406] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x75e90000 [0046.406] GetProcAddress (hModule=0x75e90000, lpProcName="IsProcessorFeaturePresent") returned 0x75ea5960 [0046.406] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0046.406] RtlAllocateHeap (HeapHandle=0x2110000, Flags=0x8, Size=0x800) returned 0x2110fa8 [0046.407] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0046.407] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x130 [0046.408] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0046.408] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x6610e6c8, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0046.408] GetVersion () returned 0x23f00206 [0046.408] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0046.409] GetUserDefaultLCID () returned 0x409 [0046.409] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0046.409] GetSystemMetrics (nIndex=5) returned 1 [0046.409] GetSystemMetrics (nIndex=6) returned 1 [0046.409] GetSystemMetrics (nIndex=11) returned 32 [0046.409] GetSystemMetrics (nIndex=12) returned 32 [0046.409] GetSystemMetrics (nIndex=34) returned 136 [0046.409] GetSystemMetrics (nIndex=35) returned 39 [0046.409] GetSystemMetrics (nIndex=0) returned 1440 [0046.410] GetSystemMetrics (nIndex=1) returned 900 [0046.410] GetSystemMetrics (nIndex=32) returned 8 [0046.410] GetSystemMetrics (nIndex=33) returned 8 [0046.410] GetSystemMetrics (nIndex=42) returned 0 [0046.410] GetStockObject (i=15) returned 0x88000b [0046.410] GetStockObject (i=7) returned 0xb00017 [0046.410] GetStockObject (i=6) returned 0xb00018 [0046.410] GetStockObject (i=8) returned 0xb00016 [0046.410] GetStockObject (i=4) returned 0x900011 [0046.410] GetStockObject (i=2) returned 0x900012 [0046.410] GetStockObject (i=0) returned 0x900010 [0046.410] GetStockObject (i=5) returned 0x900015 [0046.410] GetStockObject (i=13) returned 0x8a01c2 [0046.410] GetDC (hWnd=0x0) returned 0x60100ce [0046.410] GetTextExtentPointA (in: hdc=0x60100ce, lpString="0", c=1, lpsz=0x19f8e8 | out: lpsz=0x19f8e8) returned 1 [0046.412] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0046.412] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0046.412] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0046.412] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0046.412] GetDeviceCaps (hdc=0x60100ce, index=38) returned 32409 [0046.412] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0046.412] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x29d0000 [0046.412] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e7d0 | out: ppMalloc=0x6610e7d0*=0x75e4d000) returned 0x0 [0046.413] GetCurrentThreadId () returned 0x270 [0046.465] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x40) returned 0x4a0000 [0048.565] SetErrorMode (uMode=0x8001) returned 0x0 [0048.565] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0048.565] SetErrorMode (uMode=0x0) returned 0x8001 [0048.566] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0048.566] SetErrorMode (uMode=0x8001) returned 0x0 [0048.566] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0048.566] SetErrorMode (uMode=0x0) returned 0x8001 [0048.566] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0048.566] SetErrorMode (uMode=0x8001) returned 0x0 [0048.566] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0048.566] SetErrorMode (uMode=0x0) returned 0x8001 [0048.566] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0048.566] SetErrorMode (uMode=0x8001) returned 0x0 [0048.566] LoadLibraryA (lpLibFileName="user32") returned 0x74b70000 [0048.566] SetErrorMode (uMode=0x0) returned 0x8001 [0048.566] GetProcAddress (hModule=0x74b70000, lpProcName="EnumWindows") returned 0x74b8a3c0 [0048.567] EnumWindows (lpEnumFunc=0x4a043e, lParam=0x19fdb4) returned 1 [0048.569] GetTickCount () returned 0x114ca94 [0048.572] Sleep (dwMilliseconds=0x7d0) [0050.689] GetTickCount () returned 0x114d2e1 [0050.689] SetErrorMode (uMode=0x8001) returned 0x0 [0050.691] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.691] SetErrorMode (uMode=0x0) returned 0x8001 [0050.692] GetProcAddress (hModule=0x75e90000, lpProcName="SetErrorMode") returned 0x75ea6500 [0050.692] SetErrorMode (uMode=0x800) returned 0x0 [0050.692] SetErrorMode (uMode=0x0) returned 0x800 [0050.692] SetErrorMode (uMode=0x8001) returned 0x0 [0050.692] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.692] SetErrorMode (uMode=0x0) returned 0x8001 [0050.692] GetProcAddress (hModule=0x75e90000, lpProcName="SetLastError") returned 0x75ea4f00 [0050.692] SetLastError (dwErrCode=0x5) [0050.692] SetErrorMode (uMode=0x8001) returned 0x0 [0050.692] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.692] SetErrorMode (uMode=0x0) returned 0x8001 [0050.692] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0050.692] SetErrorMode (uMode=0x8001) returned 0x0 [0050.692] LoadLibraryA (lpLibFileName="shell32") returned 0x76480000 [0050.720] SetErrorMode (uMode=0x0) returned 0x8001 [0050.720] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteW") returned 0x765e42e0 [0050.720] SetErrorMode (uMode=0x8001) returned 0x0 [0050.720] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.720] SetErrorMode (uMode=0x0) returned 0x8001 [0050.720] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0050.720] SetErrorMode (uMode=0x8001) returned 0x0 [0050.720] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.720] SetErrorMode (uMode=0x0) returned 0x8001 [0050.720] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0050.721] SetErrorMode (uMode=0x8001) returned 0x0 [0050.721] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.721] SetErrorMode (uMode=0x0) returned 0x8001 [0050.721] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtectEx") returned 0x75ea6a50 [0050.721] SetErrorMode (uMode=0x8001) returned 0x0 [0050.721] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.721] SetErrorMode (uMode=0x0) returned 0x8001 [0050.721] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessInternalW") returned 0x75ea45f0 [0050.721] SetErrorMode (uMode=0x8001) returned 0x0 [0050.721] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.721] SetErrorMode (uMode=0x0) returned 0x8001 [0050.721] GetProcAddress (hModule=0x75e90000, lpProcName="GetTempPathW") returned 0x75efeff0 [0050.721] SetErrorMode (uMode=0x8001) returned 0x0 [0050.721] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.721] SetErrorMode (uMode=0x0) returned 0x8001 [0050.721] GetProcAddress (hModule=0x75e90000, lpProcName="GetLongPathNameW") returned 0x75ed1710 [0050.721] SetErrorMode (uMode=0x8001) returned 0x0 [0050.722] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.722] SetErrorMode (uMode=0x0) returned 0x8001 [0050.722] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSize") returned 0x75efef30 [0050.722] SetErrorMode (uMode=0x8001) returned 0x0 [0050.722] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.722] SetErrorMode (uMode=0x0) returned 0x8001 [0050.722] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0050.722] SetErrorMode (uMode=0x8001) returned 0x0 [0050.722] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.722] SetErrorMode (uMode=0x0) returned 0x8001 [0050.722] GetProcAddress (hModule=0x75e90000, lpProcName="ExitThread") returned 0x77c16390 [0050.723] SetErrorMode (uMode=0x8001) returned 0x0 [0050.723] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0050.723] SetErrorMode (uMode=0x0) returned 0x8001 [0050.723] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0050.723] GetCurrentThread () returned 0xfffffffe [0050.723] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x4ad093*=0x7ff931f41000, NumberOfBytesToProtect=0x4ad08b, NewAccessProtection=0x40, OldAccessProtection=0x4ad083 | out: BaseAddress=0x4ad093*=0x7ff931f41000, NumberOfBytesToProtect=0x4ad08b, OldAccessProtection=0x4ad083*=0x20) returned 0x0 [0050.795] SetErrorMode (uMode=0x8001) returned 0x0 [0050.795] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0050.795] SetErrorMode (uMode=0x0) returned 0x8001 [0050.795] GetProcAddress (hModule=0x77bb0000, lpProcName="NtProtectVirtualMemory") returned 0x77c22210 [0050.796] SetErrorMode (uMode=0x8001) returned 0x0 [0050.796] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0050.797] SetErrorMode (uMode=0x0) returned 0x8001 [0050.797] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgBreakPoint") returned 0x77c23fb0 [0050.797] SetErrorMode (uMode=0x8001) returned 0x0 [0050.797] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0050.797] SetErrorMode (uMode=0x0) returned 0x8001 [0050.797] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgUiRemoteBreakin") returned 0x77c5a520 [0050.797] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, NewAccessProtection=0x40, OldAccessProtection=0x19fda4 | out: BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, OldAccessProtection=0x19fda4*=0x20) returned 0x0 [0050.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, NewAccessProtection=0x20, OldAccessProtection=0x19fda4 | out: BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, OldAccessProtection=0x19fda4*=0x80) returned 0x0 [0051.196] SetErrorMode (uMode=0x8001) returned 0x0 [0051.196] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0051.197] SetErrorMode (uMode=0x0) returned 0x8001 [0051.197] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetInformationThread") returned 0x77c21dc0 [0051.201] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0051.202] SetErrorMode (uMode=0x8001) returned 0x0 [0051.202] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0051.202] SetErrorMode (uMode=0x0) returned 0x8001 [0051.202] GetProcAddress (hModule=0x77bb0000, lpProcName="NtAllocateVirtualMemory") returned 0x77c21e70 [0051.207] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fe2c*=0x0, ZeroBits=0x0, RegionSize=0x19fe28*=0x1c200000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19fe2c*=0x29e0000, RegionSize=0x19fe28*=0x1c200000) returned 0x0 [0051.217] SetErrorMode (uMode=0x8001) returned 0x0 [0051.217] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0051.217] SetErrorMode (uMode=0x0) returned 0x8001 [0051.217] GetProcAddress (hModule=0x77bb0000, lpProcName="NtGetContextThread") returned 0x77c22ba0 [0051.217] SetErrorMode (uMode=0x8001) returned 0x0 [0051.217] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0051.217] SetErrorMode (uMode=0x0) returned 0x8001 [0051.217] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetContextThread") returned 0x77c234f0 [0051.217] SetErrorMode (uMode=0x8001) returned 0x0 [0051.217] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0051.218] SetErrorMode (uMode=0x0) returned 0x8001 [0051.218] GetProcAddress (hModule=0x75e90000, lpProcName="GetStartupInfoW") returned 0x75ea5320 [0051.218] GetStartupInfoW (in: lpStartupInfo=0x29e0048 | out: lpStartupInfo=0x29e0048*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0051.222] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fe2c*=0x0, ZeroBits=0x0, RegionSize=0x19fe28*=0x1d2c, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19fe2c*=0x4b0000, RegionSize=0x19fe28*=0x2000) returned 0x0 [0051.312] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x400000, dwSize=0x12000, flNewProtect=0x4, lpflOldProtect=0x29e0c00 | out: lpflOldProtect=0x29e0c00*=0x2) returned 1 [0051.592] SetErrorMode (uMode=0x8001) returned 0x0 [0051.592] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0051.726] SetErrorMode (uMode=0x0) returned 0x8001 [0051.726] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410 [0051.726] SetErrorMode (uMode=0x8001) returned 0x0 [0051.726] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0051.726] SetErrorMode (uMode=0x0) returned 0x8001 [0051.726] GetProcAddress (hModule=0x74500000, lpProcName="WNetUseConnectionW") returned 0x7450a790 [0051.726] SetErrorMode (uMode=0x8001) returned 0x0 [0051.726] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0051.726] SetErrorMode (uMode=0x0) returned 0x8001 [0051.726] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790 [0051.726] SetErrorMode (uMode=0x8001) returned 0x0 [0051.726] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0051.727] SetErrorMode (uMode=0x0) returned 0x8001 [0051.727] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640 [0051.727] SetErrorMode (uMode=0x8001) returned 0x0 [0051.727] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.948] SetErrorMode (uMode=0x0) returned 0x8001 [0051.948] GetProcAddress (hModule=0x746a0000, lpProcName=0xa) returned 0x746afa10 [0051.948] SetErrorMode (uMode=0x8001) returned 0x0 [0051.949] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.949] SetErrorMode (uMode=0x0) returned 0x8001 [0051.949] GetProcAddress (hModule=0x746a0000, lpProcName=0x4) returned 0x746a5410 [0051.949] SetErrorMode (uMode=0x8001) returned 0x0 [0051.949] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.949] SetErrorMode (uMode=0x0) returned 0x8001 [0051.949] GetProcAddress (hModule=0x746a0000, lpProcName=0xe) returned 0x746a49d0 [0051.949] SetErrorMode (uMode=0x8001) returned 0x0 [0051.949] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.949] SetErrorMode (uMode=0x0) returned 0x8001 [0051.949] GetProcAddress (hModule=0x746a0000, lpProcName=0x12) returned 0x746a4ea0 [0051.949] SetErrorMode (uMode=0x8001) returned 0x0 [0051.949] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.949] SetErrorMode (uMode=0x0) returned 0x8001 [0051.949] GetProcAddress (hModule=0x746a0000, lpProcName=0x5) returned 0x746b43d0 [0051.949] SetErrorMode (uMode=0x8001) returned 0x0 [0051.950] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.950] SetErrorMode (uMode=0x0) returned 0x8001 [0051.950] GetProcAddress (hModule=0x746a0000, lpProcName=0x9) returned 0x746b8ff0 [0051.950] SetErrorMode (uMode=0x8001) returned 0x0 [0051.950] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.950] SetErrorMode (uMode=0x0) returned 0x8001 [0051.950] GetProcAddress (hModule=0x746a0000, lpProcName=0x10) returned 0x746b0c50 [0051.950] SetErrorMode (uMode=0x8001) returned 0x0 [0051.950] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.950] SetErrorMode (uMode=0x0) returned 0x8001 [0051.950] GetProcAddress (hModule=0x746a0000, lpProcName=0x17) returned 0x746b4510 [0051.950] SetErrorMode (uMode=0x8001) returned 0x0 [0051.950] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.950] SetErrorMode (uMode=0x0) returned 0x8001 [0051.950] GetProcAddress (hModule=0x746a0000, lpProcName=0x3) returned 0x746b0910 [0051.951] SetErrorMode (uMode=0x8001) returned 0x0 [0051.951] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.951] SetErrorMode (uMode=0x0) returned 0x8001 [0051.951] GetProcAddress (hModule=0x746a0000, lpProcName=0x7) returned 0x746b3b30 [0051.951] SetErrorMode (uMode=0x8001) returned 0x0 [0051.951] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.951] SetErrorMode (uMode=0x0) returned 0x8001 [0051.951] GetProcAddress (hModule=0x746a0000, lpProcName="WSAAddressToStringW") returned 0x746b45d0 [0051.951] SetErrorMode (uMode=0x8001) returned 0x0 [0051.951] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.951] SetErrorMode (uMode=0x0) returned 0x8001 [0051.951] GetProcAddress (hModule=0x746a0000, lpProcName=0x73) returned 0x746a5b40 [0051.951] SetErrorMode (uMode=0x8001) returned 0x0 [0051.951] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.951] SetErrorMode (uMode=0x0) returned 0x8001 [0051.951] GetProcAddress (hModule=0x746a0000, lpProcName=0x8) returned 0x746a49d0 [0051.952] SetErrorMode (uMode=0x8001) returned 0x0 [0051.952] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0051.952] SetErrorMode (uMode=0x0) returned 0x8001 [0051.952] GetProcAddress (hModule=0x746a0000, lpProcName=0x6f) returned 0x746b8fe0 [0051.952] SetErrorMode (uMode=0x8001) returned 0x0 [0051.952] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x744d0000 [0052.072] SetErrorMode (uMode=0x0) returned 0x8001 [0052.072] GetProcAddress (hModule=0x744d0000, lpProcName="GetIpAddrTable") returned 0x744ef960 [0052.072] SetErrorMode (uMode=0x8001) returned 0x0 [0052.072] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.072] SetErrorMode (uMode=0x0) returned 0x8001 [0052.072] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0052.072] SetErrorMode (uMode=0x8001) returned 0x0 [0052.073] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.073] SetErrorMode (uMode=0x0) returned 0x8001 [0052.073] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0052.073] SetErrorMode (uMode=0x8001) returned 0x0 [0052.073] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.073] SetErrorMode (uMode=0x0) returned 0x8001 [0052.073] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0052.073] SetErrorMode (uMode=0x8001) returned 0x0 [0052.073] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.073] SetErrorMode (uMode=0x0) returned 0x8001 [0052.073] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0052.073] SetErrorMode (uMode=0x8001) returned 0x0 [0052.073] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.074] SetErrorMode (uMode=0x0) returned 0x8001 [0052.074] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0052.074] SetErrorMode (uMode=0x8001) returned 0x0 [0052.074] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.074] SetErrorMode (uMode=0x0) returned 0x8001 [0052.074] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0052.074] SetErrorMode (uMode=0x8001) returned 0x0 [0052.074] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.074] SetErrorMode (uMode=0x0) returned 0x8001 [0052.074] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0052.074] SetErrorMode (uMode=0x8001) returned 0x0 [0052.074] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.074] SetErrorMode (uMode=0x0) returned 0x8001 [0052.074] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0052.074] SetErrorMode (uMode=0x8001) returned 0x0 [0052.075] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.075] SetErrorMode (uMode=0x0) returned 0x8001 [0052.075] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0052.075] SetErrorMode (uMode=0x8001) returned 0x0 [0052.075] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.075] SetErrorMode (uMode=0x0) returned 0x8001 [0052.075] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0052.075] SetErrorMode (uMode=0x8001) returned 0x0 [0052.075] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.075] SetErrorMode (uMode=0x0) returned 0x8001 [0052.075] GetProcAddress (hModule=0x75e90000, lpProcName="SetEvent") returned 0x75efec50 [0052.075] SetErrorMode (uMode=0x8001) returned 0x0 [0052.075] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.075] SetErrorMode (uMode=0x0) returned 0x8001 [0052.075] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0052.076] SetErrorMode (uMode=0x8001) returned 0x0 [0052.076] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.076] SetErrorMode (uMode=0x0) returned 0x8001 [0052.076] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0052.076] SetErrorMode (uMode=0x8001) returned 0x0 [0052.076] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.076] SetErrorMode (uMode=0x0) returned 0x8001 [0052.076] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0052.076] SetErrorMode (uMode=0x8001) returned 0x0 [0052.076] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.076] SetErrorMode (uMode=0x0) returned 0x8001 [0052.076] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileW") returned 0x75eff3b0 [0052.076] SetErrorMode (uMode=0x8001) returned 0x0 [0052.076] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.076] SetErrorMode (uMode=0x0) returned 0x8001 [0052.077] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventW") returned 0x75efeb30 [0052.077] SetErrorMode (uMode=0x8001) returned 0x0 [0052.077] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.077] SetErrorMode (uMode=0x0) returned 0x8001 [0052.077] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0052.077] SetErrorMode (uMode=0x8001) returned 0x0 [0052.077] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.077] SetErrorMode (uMode=0x0) returned 0x8001 [0052.077] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0052.077] SetErrorMode (uMode=0x8001) returned 0x0 [0052.077] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.077] SetErrorMode (uMode=0x0) returned 0x8001 [0052.077] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0052.077] SetErrorMode (uMode=0x8001) returned 0x0 [0052.077] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.077] SetErrorMode (uMode=0x0) returned 0x8001 [0052.078] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0052.078] SetErrorMode (uMode=0x8001) returned 0x0 [0052.078] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.078] SetErrorMode (uMode=0x0) returned 0x8001 [0052.078] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0052.078] SetErrorMode (uMode=0x8001) returned 0x0 [0052.078] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.078] SetErrorMode (uMode=0x0) returned 0x8001 [0052.078] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0052.078] SetErrorMode (uMode=0x8001) returned 0x0 [0052.078] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.078] SetErrorMode (uMode=0x0) returned 0x8001 [0052.078] GetProcAddress (hModule=0x75e90000, lpProcName="ResetEvent") returned 0x75efec40 [0052.078] SetErrorMode (uMode=0x8001) returned 0x0 [0052.078] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.078] SetErrorMode (uMode=0x0) returned 0x8001 [0052.079] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0052.079] SetErrorMode (uMode=0x8001) returned 0x0 [0052.079] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.079] SetErrorMode (uMode=0x0) returned 0x8001 [0052.079] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0052.079] SetErrorMode (uMode=0x8001) returned 0x0 [0052.079] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.079] SetErrorMode (uMode=0x0) returned 0x8001 [0052.079] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0052.079] SetErrorMode (uMode=0x8001) returned 0x0 [0052.079] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.079] SetErrorMode (uMode=0x0) returned 0x8001 [0052.079] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0052.079] SetErrorMode (uMode=0x8001) returned 0x0 [0052.079] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.080] SetErrorMode (uMode=0x0) returned 0x8001 [0052.080] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0052.080] SetErrorMode (uMode=0x8001) returned 0x0 [0052.080] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.080] SetErrorMode (uMode=0x0) returned 0x8001 [0052.080] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0052.080] SetErrorMode (uMode=0x8001) returned 0x0 [0052.080] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.080] SetErrorMode (uMode=0x0) returned 0x8001 [0052.080] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0052.080] SetErrorMode (uMode=0x8001) returned 0x0 [0052.080] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.080] SetErrorMode (uMode=0x0) returned 0x8001 [0052.080] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoW") returned 0x75ea5040 [0052.080] SetErrorMode (uMode=0x8001) returned 0x0 [0052.080] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.081] SetErrorMode (uMode=0x0) returned 0x8001 [0052.081] GetProcAddress (hModule=0x75e90000, lpProcName="ReadProcessMemory") returned 0x75ea5e30 [0052.081] SetErrorMode (uMode=0x8001) returned 0x0 [0052.081] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.081] SetErrorMode (uMode=0x0) returned 0x8001 [0052.081] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0052.081] SetErrorMode (uMode=0x8001) returned 0x0 [0052.081] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.081] SetErrorMode (uMode=0x0) returned 0x8001 [0052.081] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0052.081] SetErrorMode (uMode=0x8001) returned 0x0 [0052.081] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.081] SetErrorMode (uMode=0x0) returned 0x8001 [0052.081] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0052.081] SetErrorMode (uMode=0x8001) returned 0x0 [0052.082] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.082] SetErrorMode (uMode=0x0) returned 0x8001 [0052.082] GetProcAddress (hModule=0x75e90000, lpProcName="FlushFileBuffers") returned 0x75efee70 [0052.082] SetErrorMode (uMode=0x8001) returned 0x0 [0052.082] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.082] SetErrorMode (uMode=0x0) returned 0x8001 [0052.082] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0052.082] SetErrorMode (uMode=0x8001) returned 0x0 [0052.082] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.082] SetErrorMode (uMode=0x0) returned 0x8001 [0052.082] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0052.082] SetErrorMode (uMode=0x8001) returned 0x0 [0052.082] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.082] SetErrorMode (uMode=0x0) returned 0x8001 [0052.082] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThreadId") returned 0x75ea8820 [0052.082] SetErrorMode (uMode=0x8001) returned 0x0 [0052.083] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.083] SetErrorMode (uMode=0x0) returned 0x8001 [0052.083] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0052.083] SetErrorMode (uMode=0x8001) returned 0x0 [0052.083] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.083] SetErrorMode (uMode=0x0) returned 0x8001 [0052.083] GetProcAddress (hModule=0x75e90000, lpProcName="GetExitCodeThread") returned 0x75ea4ff0 [0052.083] SetErrorMode (uMode=0x8001) returned 0x0 [0052.083] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.083] SetErrorMode (uMode=0x0) returned 0x8001 [0052.083] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0052.083] SetErrorMode (uMode=0x8001) returned 0x0 [0052.083] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.083] SetErrorMode (uMode=0x0) returned 0x8001 [0052.084] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0052.084] SetErrorMode (uMode=0x8001) returned 0x0 [0052.084] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.084] SetErrorMode (uMode=0x0) returned 0x8001 [0052.084] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0052.084] SetErrorMode (uMode=0x8001) returned 0x0 [0052.084] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.084] SetErrorMode (uMode=0x0) returned 0x8001 [0052.084] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0052.084] SetErrorMode (uMode=0x8001) returned 0x0 [0052.084] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.084] SetErrorMode (uMode=0x0) returned 0x8001 [0052.084] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0052.084] SetErrorMode (uMode=0x8001) returned 0x0 [0052.084] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.084] SetErrorMode (uMode=0x0) returned 0x8001 [0052.085] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0052.085] SetErrorMode (uMode=0x8001) returned 0x0 [0052.085] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.085] SetErrorMode (uMode=0x0) returned 0x8001 [0052.085] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0052.085] SetErrorMode (uMode=0x8001) returned 0x0 [0052.085] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.085] SetErrorMode (uMode=0x0) returned 0x8001 [0052.085] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0052.085] SetErrorMode (uMode=0x8001) returned 0x0 [0052.085] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.085] SetErrorMode (uMode=0x0) returned 0x8001 [0052.085] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0052.085] SetErrorMode (uMode=0x8001) returned 0x0 [0052.085] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.085] SetErrorMode (uMode=0x0) returned 0x8001 [0052.086] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0052.086] SetErrorMode (uMode=0x8001) returned 0x0 [0052.086] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.086] SetErrorMode (uMode=0x0) returned 0x8001 [0052.086] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0052.086] SetErrorMode (uMode=0x8001) returned 0x0 [0052.086] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.086] SetErrorMode (uMode=0x0) returned 0x8001 [0052.086] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0052.086] SetErrorMode (uMode=0x8001) returned 0x0 [0052.086] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.086] SetErrorMode (uMode=0x0) returned 0x8001 [0052.086] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0052.086] SetErrorMode (uMode=0x8001) returned 0x0 [0052.086] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.087] SetErrorMode (uMode=0x0) returned 0x8001 [0052.087] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0052.087] SetErrorMode (uMode=0x8001) returned 0x0 [0052.087] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.087] SetErrorMode (uMode=0x0) returned 0x8001 [0052.087] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0052.087] SetErrorMode (uMode=0x8001) returned 0x0 [0052.087] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.087] SetErrorMode (uMode=0x0) returned 0x8001 [0052.087] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0052.087] SetErrorMode (uMode=0x8001) returned 0x0 [0052.087] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.087] SetErrorMode (uMode=0x0) returned 0x8001 [0052.087] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0052.087] SetErrorMode (uMode=0x8001) returned 0x0 [0052.087] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.088] SetErrorMode (uMode=0x0) returned 0x8001 [0052.088] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0052.088] SetErrorMode (uMode=0x8001) returned 0x0 [0052.088] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.088] SetErrorMode (uMode=0x0) returned 0x8001 [0052.088] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0052.088] SetErrorMode (uMode=0x8001) returned 0x0 [0052.088] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.088] SetErrorMode (uMode=0x0) returned 0x8001 [0052.088] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocalTime") returned 0x75ea5060 [0052.088] SetErrorMode (uMode=0x8001) returned 0x0 [0052.088] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0052.088] SetErrorMode (uMode=0x0) returned 0x8001 [0052.088] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0052.088] SetErrorMode (uMode=0x8001) returned 0x0 [0052.088] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74b70000 [0052.089] SetErrorMode (uMode=0x0) returned 0x8001 [0052.089] GetProcAddress (hModule=0x74b70000, lpProcName="GetShellWindow") returned 0x74ba1150 [0052.089] SetErrorMode (uMode=0x8001) returned 0x0 [0052.089] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74b70000 [0052.089] SetErrorMode (uMode=0x0) returned 0x8001 [0052.089] GetProcAddress (hModule=0x74b70000, lpProcName="GetWindowThreadProcessId") returned 0x74b9eb60 [0052.089] SetErrorMode (uMode=0x8001) returned 0x0 [0052.089] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.089] SetErrorMode (uMode=0x0) returned 0x8001 [0052.089] GetProcAddress (hModule=0x761b0000, lpProcName="DuplicateTokenEx") returned 0x761d0370 [0052.089] SetErrorMode (uMode=0x8001) returned 0x0 [0052.089] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.090] SetErrorMode (uMode=0x0) returned 0x8001 [0052.090] GetProcAddress (hModule=0x761b0000, lpProcName="LookupAccountSidW") returned 0x761cf100 [0052.090] SetErrorMode (uMode=0x8001) returned 0x0 [0052.090] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.090] SetErrorMode (uMode=0x0) returned 0x8001 [0052.090] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0052.090] SetErrorMode (uMode=0x8001) returned 0x0 [0052.090] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.090] SetErrorMode (uMode=0x0) returned 0x8001 [0052.090] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0052.090] SetErrorMode (uMode=0x8001) returned 0x0 [0052.090] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.090] SetErrorMode (uMode=0x0) returned 0x8001 [0052.090] GetProcAddress (hModule=0x761b0000, lpProcName="EqualSid") returned 0x761cffe0 [0052.090] SetErrorMode (uMode=0x8001) returned 0x0 [0052.091] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.091] SetErrorMode (uMode=0x0) returned 0x8001 [0052.091] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0052.091] SetErrorMode (uMode=0x8001) returned 0x0 [0052.091] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.091] SetErrorMode (uMode=0x0) returned 0x8001 [0052.091] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0052.091] SetErrorMode (uMode=0x8001) returned 0x0 [0052.091] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.091] SetErrorMode (uMode=0x0) returned 0x8001 [0052.091] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0052.091] SetErrorMode (uMode=0x8001) returned 0x0 [0052.091] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.091] SetErrorMode (uMode=0x0) returned 0x8001 [0052.091] GetProcAddress (hModule=0x761b0000, lpProcName="FreeSid") returned 0x761cfa80 [0052.091] SetErrorMode (uMode=0x8001) returned 0x0 [0052.092] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.092] SetErrorMode (uMode=0x0) returned 0x8001 [0052.092] GetProcAddress (hModule=0x761b0000, lpProcName="AllocateAndInitializeSid") returned 0x761cf440 [0052.092] SetErrorMode (uMode=0x8001) returned 0x0 [0052.092] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0052.092] SetErrorMode (uMode=0x0) returned 0x8001 [0052.092] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0052.092] SetErrorMode (uMode=0x8001) returned 0x0 [0052.092] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x76480000 [0052.092] SetErrorMode (uMode=0x0) returned 0x8001 [0052.092] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0052.092] SetErrorMode (uMode=0x8001) returned 0x0 [0052.092] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77920000 [0052.092] SetErrorMode (uMode=0x0) returned 0x8001 [0052.092] GetProcAddress (hModule=0x77920000, lpProcName="CoGetObject") returned 0x77953cc0 [0052.093] SetErrorMode (uMode=0x8001) returned 0x0 [0052.093] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77920000 [0052.093] SetErrorMode (uMode=0x0) returned 0x8001 [0052.093] GetProcAddress (hModule=0x77920000, lpProcName="CoInitializeEx") returned 0x75d32590 [0052.093] SetErrorMode (uMode=0x8001) returned 0x0 [0052.093] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77920000 [0052.093] SetErrorMode (uMode=0x0) returned 0x8001 [0052.093] GetProcAddress (hModule=0x77920000, lpProcName="CoUninitialize") returned 0x75d322b0 [0052.099] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.099] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x401000, dwSize=0x7bb8, flNewProtect=0x20, lpflOldProtect=0x29e0c00 | out: lpflOldProtect=0x29e0c00*=0x4) returned 1 [0052.104] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.104] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x409000, dwSize=0xc4a, flNewProtect=0x4, lpflOldProtect=0x29e0c00 | out: lpflOldProtect=0x29e0c00*=0x4) returned 1 [0052.109] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.117] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x40a000, dwSize=0x2719, flNewProtect=0x4, lpflOldProtect=0x29e0c00 | out: lpflOldProtect=0x29e0c00*=0x4) returned 1 [0052.122] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.122] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x40d000, dwSize=0x558, flNewProtect=0x4, lpflOldProtect=0x29e0c00 | out: lpflOldProtect=0x29e0c00*=0x4) returned 1 [0052.127] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.127] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x40e000, dwSize=0x35cc, flNewProtect=0x4, lpflOldProtect=0x29e0c00 | out: lpflOldProtect=0x29e0c00*=0x4) returned 1 [0052.132] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.132] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x29e0c00 | out: lpflOldProtect=0x29e0c00*=0x4) returned 1 [0052.132] SetErrorMode (uMode=0x8001) returned 0x0 [0052.132] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0052.132] SetErrorMode (uMode=0x0) returned 0x8001 [0052.132] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0052.132] SetErrorMode (uMode=0x8001) returned 0x0 [0052.132] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0052.133] SetErrorMode (uMode=0x0) returned 0x8001 [0052.133] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0052.133] SetErrorMode (uMode=0x8001) returned 0x0 [0052.133] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0052.133] SetErrorMode (uMode=0x0) returned 0x8001 [0052.133] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateThread") returned 0x75ea6800 [0052.137] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402518, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0052.143] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.148] NtSetInformationThread (ThreadHandle=0x1f8, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0052.148] GetCurrentThread () returned 0xfffffffe [0052.152] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x29e4004 | out: Context=0x29e4004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0052.211] TerminateThread (hThread=0xfffffffe, dwExitCode=0x0) Thread: id = 4 os_tid = 0xc48 Thread: id = 5 os_tid = 0x1a4 [0052.181] GetCurrentThreadId () returned 0x1a4 [0052.191] GetProcessHeap () returned 0x580000 [0052.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x30) returned 0x59dd60 [0052.196] GetProcessHeap () returned 0x580000 [0052.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33c0) returned 0x59e9b8 [0052.201] GetProcessHeap () returned 0x580000 [0052.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x204) returned 0x5a1d80 [0052.205] GetProcessHeap () returned 0x580000 [0052.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x58a560 [0052.210] GetTickCount () returned 0x114d8cd [0052.210] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x20efde8 | out: lpWSAData=0x20efde8) returned 0 [0052.226] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x20efdc8, cchData=32 | out: lpLCData="\x03") returned 16 [0052.226] GetProcessHeap () returned 0x580000 [0052.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5882d0 [0052.242] GetProcessHeap () returned 0x580000 [0052.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x584298 [0052.247] GetVersion () returned 0x23f00206 [0052.247] GetCurrentProcess () returned 0xffffffff [0052.247] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x20efd3c | out: TokenHandle=0x20efd3c*=0x208) returned 1 [0052.247] GetTokenInformation (in: TokenHandle=0x208, TokenInformationClass=0x14, TokenInformation=0x20efd34, TokenInformationLength=0x4, ReturnLength=0x20efd38 | out: TokenInformation=0x20efd34, ReturnLength=0x20efd38) returned 1 [0052.247] CloseHandle (hObject=0x208) returned 1 [0052.247] GetProcessHeap () returned 0x580000 [0052.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x584758 [0052.252] GetProcessHeap () returned 0x580000 [0052.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x584780 [0052.256] GetProcessHeap () returned 0x580000 [0052.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6e20 [0052.261] GetProcessHeap () returned 0x580000 [0052.266] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x588440 [0052.266] GetProcessHeap () returned 0x580000 [0052.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588440 | out: hHeap=0x580000) returned 1 [0052.266] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x584780, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.266] GetProcessHeap () returned 0x580000 [0052.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6e20 | out: hHeap=0x580000) returned 1 [0052.266] GetProcessHeap () returned 0x580000 [0052.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x584758 | out: hHeap=0x580000) returned 1 [0052.266] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20efcdc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20efcdc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.266] GetProcessHeap () returned 0x580000 [0052.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x584780 | out: hHeap=0x580000) returned 1 [0052.266] GetProcessHeap () returned 0x580000 [0052.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x591dd8 [0052.271] GetProcessHeap () returned 0x580000 [0052.275] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x591fd0 [0052.275] GetProcessHeap () returned 0x580000 [0052.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x591fd0, Size=0x72) returned 0x588440 [0052.285] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0052.312] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x208 [0052.317] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x0 [0052.339] GetProcessHeap () returned 0x580000 [0052.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x591dd8 | out: hHeap=0x580000) returned 1 [0052.339] GetProcessHeap () returned 0x580000 [0052.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588440 | out: hHeap=0x580000) returned 1 [0052.339] GetProcessHeap () returned 0x580000 [0052.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6b28 [0052.344] GetProcessHeap () returned 0x580000 [0052.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6da8 [0052.348] GetProcessHeap () returned 0x580000 [0052.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6ad8 [0052.352] GetProcessHeap () returned 0x580000 [0052.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x588440 [0052.357] GetProcessHeap () returned 0x580000 [0052.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588440 | out: hHeap=0x580000) returned 1 [0052.357] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5a6da8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0052.357] GetProcessHeap () returned 0x580000 [0052.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6ad8 | out: hHeap=0x580000) returned 1 [0052.357] GetProcessHeap () returned 0x580000 [0052.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b28 | out: hHeap=0x580000) returned 1 [0052.357] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20efcc4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20efcc4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0052.357] GetProcessHeap () returned 0x580000 [0052.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6da8 | out: hHeap=0x580000) returned 1 [0052.357] GetProcessHeap () returned 0x580000 [0052.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5923c0 [0052.362] GetProcessHeap () returned 0x580000 [0052.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5922e8 [0052.366] GetProcessHeap () returned 0x580000 [0052.371] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5922e8, Size=0x72) returned 0x588440 [0052.495] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0052.495] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x20c [0052.496] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x0 [0052.496] GetProcessHeap () returned 0x580000 [0052.496] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5923c0 | out: hHeap=0x580000) returned 1 [0052.496] GetProcessHeap () returned 0x580000 [0052.496] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588440 | out: hHeap=0x580000) returned 1 [0052.496] ReleaseMutex (hMutex=0x20c) returned 1 [0052.496] CloseHandle (hObject=0x20c) returned 1 [0052.496] GetProcessHeap () returned 0x580000 [0052.500] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x30) returned 0x59dd98 [0052.500] GetProcessHeap () returned 0x580000 [0052.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a6e90 [0052.505] GetVersion () returned 0x23f00206 [0052.505] GetProcessHeap () returned 0x580000 [0052.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x588440 [0052.510] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0052.510] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0052.510] Wow64DisableWow64FsRedirection (in: OldValue=0x20efd18 | out: OldValue=0x20efd18*=0x0) returned 1 [0052.510] GetProcessHeap () returned 0x580000 [0052.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588440 | out: hHeap=0x580000) returned 1 [0052.510] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0052.510] GetProcAddress (hModule=0x761b0000, lpProcName="CreateProcessWithTokenW") returned 0x761c0c70 [0052.510] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5a6e90, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0052.510] GetShellWindow () returned 0x100f0 [0052.511] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x20efd24 | out: lpdwProcessId=0x20efd24) returned 0x864 [0052.512] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x860) returned 0x214 [0052.512] OpenProcessToken (in: ProcessHandle=0x214, DesiredAccess=0x2000000, TokenHandle=0x20efd34 | out: TokenHandle=0x20efd34*=0x218) returned 1 [0052.512] DuplicateTokenEx (in: hExistingToken=0x218, dwDesiredAccess=0x2000000, lpTokenAttributes=0x20efcfc, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x20efd38 | out: phNewToken=0x20efd38*=0x21c) returned 1 [0052.512] CreateProcessWithTokenW (in: hToken=0x21c, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x20efcb0*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x20efd08 | out: lpCommandLine=0x0, lpProcessInformation=0x20efd08*(hProcess=0x258, hThread=0x25c, dwProcessId=0xd98, dwThreadId=0x4c8)) returned 1 [0052.806] GetProcessHeap () returned 0x580000 [0052.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x5a84b8 [0052.811] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0052.811] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75ea6b50 [0052.811] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0052.811] GetProcessHeap () returned 0x580000 [0052.811] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a84b8 | out: hHeap=0x580000) returned 1 [0052.811] CloseHandle (hObject=0x214) returned 1 [0052.811] CloseHandle (hObject=0x258) returned 1 [0052.811] CloseHandle (hObject=0x25c) returned 1 [0052.812] CloseHandle (hObject=0x218) returned 1 [0052.812] CloseHandle (hObject=0x21c) returned 1 [0052.812] GetProcessHeap () returned 0x580000 [0052.812] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6e90 | out: hHeap=0x580000) returned 1 [0052.812] GetProcessHeap () returned 0x580000 [0052.812] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59dd98 | out: hHeap=0x580000) returned 1 [0052.812] Sleep (dwMilliseconds=0x1388) [0057.935] GetProcessHeap () returned 0x580000 [0057.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x60) returned 0x59a860 [0057.940] GetProcessHeap () returned 0x580000 [0057.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6ce0 [0057.944] GetProcessHeap () returned 0x580000 [0057.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6b78 [0057.949] GetProcessHeap () returned 0x580000 [0057.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6c90 [0057.954] GetProcessHeap () returned 0x580000 [0057.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x588e60 [0057.958] GetProcessHeap () returned 0x580000 [0057.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588e60 | out: hHeap=0x580000) returned 1 [0057.958] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x5a6b78, nSize=0xf | out: lpDst="") returned 0x1e [0057.958] GetProcessHeap () returned 0x580000 [0057.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6c90 | out: hHeap=0x580000) returned 1 [0057.958] GetProcessHeap () returned 0x580000 [0057.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a6b78, Size=0x3a) returned 0x592408 [0057.964] GetProcessHeap () returned 0x580000 [0057.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a) returned 0x591dd8 [0057.968] GetProcessHeap () returned 0x580000 [0057.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x588e60 [0057.973] GetProcessHeap () returned 0x580000 [0057.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588e60 | out: hHeap=0x580000) returned 1 [0057.973] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x592408, nSize=0x1d | out: lpDst="") returned 0x1e [0057.973] GetProcessHeap () returned 0x580000 [0057.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x591dd8 | out: hHeap=0x580000) returned 1 [0057.973] GetProcessHeap () returned 0x580000 [0057.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x592408, Size=0x72) returned 0x588e60 [0058.056] GetProcessHeap () returned 0x580000 [0058.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x72) returned 0x5a8060 [0058.060] GetProcessHeap () returned 0x580000 [0058.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5aac58 [0058.064] GetProcessHeap () returned 0x580000 [0058.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aac58 | out: hHeap=0x580000) returned 1 [0058.064] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x588e60, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0058.064] GetProcessHeap () returned 0x580000 [0058.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a8060 | out: hHeap=0x580000) returned 1 [0058.064] GetProcessHeap () returned 0x580000 [0058.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6ce0 | out: hHeap=0x580000) returned 1 [0058.064] GetProcessHeap () returned 0x580000 [0058.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x591dd8 [0058.069] GetProcessHeap () returned 0x580000 [0058.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3e) returned 0x592258 [0058.074] GetProcessHeap () returned 0x580000 [0058.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e) returned 0x592180 [0058.078] GetProcessHeap () returned 0x580000 [0058.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a8060 [0058.082] GetProcessHeap () returned 0x580000 [0058.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x10) returned 0x587d30 [0058.087] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc1c | out: phkResult=0x20efc1c*=0x218) returned 0x0 [0058.087] RegQueryValueExW (in: hKey=0x218, lpValueName="Startup", lpReserved=0x0, lpType=0x20efc18, lpData=0x592180, lpcbData=0x20efc20*=0x3e | out: lpType=0x20efc18*=0x2, lpData=0x592180*=0x0, lpcbData=0x20efc20*=0x98) returned 0xea [0058.087] RegCloseKey (hKey=0x218) returned 0x0 [0058.087] GetProcessHeap () returned 0x580000 [0058.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x587d30 | out: hHeap=0x580000) returned 1 [0058.087] GetProcessHeap () returned 0x580000 [0058.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a8060 | out: hHeap=0x580000) returned 1 [0058.087] GetProcessHeap () returned 0x580000 [0058.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x592180 | out: hHeap=0x580000) returned 1 [0058.087] GetProcessHeap () returned 0x580000 [0058.092] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x592258, Size=0x7a) returned 0x5a8060 [0058.092] GetProcessHeap () returned 0x580000 [0058.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a) returned 0x5aac58 [0058.096] GetProcessHeap () returned 0x580000 [0058.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5aace0 [0058.101] GetProcessHeap () returned 0x580000 [0058.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x10) returned 0x587d30 [0058.232] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc1c | out: phkResult=0x20efc1c*=0x218) returned 0x0 [0058.232] RegQueryValueExW (in: hKey=0x218, lpValueName="Startup", lpReserved=0x0, lpType=0x20efc18, lpData=0x5aac58, lpcbData=0x20efc20*=0x7a | out: lpType=0x20efc18*=0x2, lpData=0x5aac58*=0x90, lpcbData=0x20efc20*=0x98) returned 0xea [0058.232] RegCloseKey (hKey=0x218) returned 0x0 [0058.232] GetProcessHeap () returned 0x580000 [0058.232] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x587d30 | out: hHeap=0x580000) returned 1 [0058.233] GetProcessHeap () returned 0x580000 [0058.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aace0 | out: hHeap=0x580000) returned 1 [0058.233] GetProcessHeap () returned 0x580000 [0058.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aac58 | out: hHeap=0x580000) returned 1 [0058.233] GetProcessHeap () returned 0x580000 [0058.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a8060, Size=0xf2) returned 0x5aac58 [0058.237] GetProcessHeap () returned 0x580000 [0058.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf2) returned 0x5aad58 [0058.242] GetProcessHeap () returned 0x580000 [0058.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a8060 [0058.251] GetProcessHeap () returned 0x580000 [0058.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x10) returned 0x587cb8 [0058.256] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc1c | out: phkResult=0x20efc1c*=0x218) returned 0x0 [0058.260] RegQueryValueExW (in: hKey=0x218, lpValueName="Startup", lpReserved=0x0, lpType=0x20efc18, lpData=0x5aad58, lpcbData=0x20efc20*=0xf2 | out: lpType=0x20efc18*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x20efc20*=0x98) returned 0x0 [0058.264] RegCloseKey (hKey=0x218) returned 0x0 [0058.269] GetProcessHeap () returned 0x580000 [0058.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x587cb8 | out: hHeap=0x580000) returned 1 [0058.269] GetProcessHeap () returned 0x580000 [0058.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6d30 [0058.286] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc1c | out: phkResult=0x20efc1c*=0x218) returned 0x0 [0058.286] RegQueryValueExW (in: hKey=0x218, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20efc18, lpData=0x5aadf0, lpcbData=0x20efc20*=0x5a | out: lpType=0x20efc18*=0x0, lpData=0x5aadf0*=0x0, lpcbData=0x20efc20*=0x5a) returned 0x2 [0058.286] RegCloseKey (hKey=0x218) returned 0x0 [0058.286] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc30 | out: phkResult=0x20efc30*=0x218) returned 0x0 [0058.286] RegQueryValueExW (in: hKey=0x218, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20efc2c, lpData=0x5aadf0, lpcbData=0x20efc34*=0x5a | out: lpType=0x20efc2c*=0x2, lpData=0x5aadf0*=0x0, lpcbData=0x20efc34*=0x78) returned 0xea [0058.286] RegCloseKey (hKey=0x218) returned 0x0 [0058.286] GetProcessHeap () returned 0x580000 [0058.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6d30 | out: hHeap=0x580000) returned 1 [0058.286] GetProcessHeap () returned 0x580000 [0058.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a8060 | out: hHeap=0x580000) returned 1 [0058.286] GetProcessHeap () returned 0x580000 [0058.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aad58 | out: hHeap=0x580000) returned 1 [0058.286] GetProcessHeap () returned 0x580000 [0058.291] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5aac58, Size=0x1e2) returned 0x5aac58 [0058.291] GetProcessHeap () returned 0x580000 [0058.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e2) returned 0x5a6e90 [0058.295] GetProcessHeap () returned 0x580000 [0058.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a8060 [0058.299] GetProcessHeap () returned 0x580000 [0058.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x10) returned 0x587d30 [0058.304] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc1c | out: phkResult=0x20efc1c*=0x218) returned 0x0 [0058.304] RegQueryValueExW (in: hKey=0x218, lpValueName="Startup", lpReserved=0x0, lpType=0x20efc18, lpData=0x5a6e90, lpcbData=0x20efc20*=0x1e2 | out: lpType=0x20efc18*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x20efc20*=0x98) returned 0x0 [0058.304] RegCloseKey (hKey=0x218) returned 0x0 [0058.304] GetProcessHeap () returned 0x580000 [0058.304] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x587d30 | out: hHeap=0x580000) returned 1 [0058.304] GetProcessHeap () returned 0x580000 [0058.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6dd0 [0058.622] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc1c | out: phkResult=0x20efc1c*=0x218) returned 0x0 [0058.622] RegQueryValueExW (in: hKey=0x218, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20efc18, lpData=0x5a6f28, lpcbData=0x20efc20*=0x14a | out: lpType=0x20efc18*=0x0, lpData=0x5a6f28*=0x0, lpcbData=0x20efc20*=0x14a) returned 0x2 [0058.623] RegCloseKey (hKey=0x218) returned 0x0 [0058.623] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x20efc30 | out: phkResult=0x20efc30*=0x218) returned 0x0 [0058.623] RegQueryValueExW (in: hKey=0x218, lpValueName="Common Startup", lpReserved=0x0, lpType=0x20efc2c, lpData=0x5a6f28, lpcbData=0x20efc34*=0x14a | out: lpType=0x20efc2c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x20efc34*=0x78) returned 0x0 [0058.623] RegCloseKey (hKey=0x218) returned 0x0 [0058.623] GetProcessHeap () returned 0x580000 [0058.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6dd0 | out: hHeap=0x580000) returned 1 [0058.623] GetProcessHeap () returned 0x580000 [0058.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a8060 | out: hHeap=0x580000) returned 1 [0058.623] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x5aac58, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0058.623] GetProcessHeap () returned 0x580000 [0058.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6e90 | out: hHeap=0x580000) returned 1 [0058.623] GetProcessHeap () returned 0x580000 [0058.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x591dd8 | out: hHeap=0x580000) returned 1 [0058.623] GetProcessHeap () returned 0x580000 [0058.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a6e90 [0058.628] GetProcessHeap () returned 0x580000 [0058.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a7788 [0058.632] GetProcessHeap () returned 0x580000 [0058.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a79a0 [0058.637] GetProcessHeap () returned 0x580000 [0058.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a7bb8 [0058.641] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5a6e90, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0058.641] GetProcessHeap () returned 0x580000 [0058.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5aae48 [0058.646] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5aae48, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0058.646] GetProcessHeap () returned 0x580000 [0058.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aae48 | out: hHeap=0x580000) returned 1 [0058.646] GetProcessHeap () returned 0x580000 [0058.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5aae48 [0058.650] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5aae48, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0058.651] GetProcessHeap () returned 0x580000 [0058.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aae48 | out: hHeap=0x580000) returned 1 [0058.651] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\gasas.exe"), bFailIfExists=0) returned 1 [0058.956] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x20efd18 | out: phkResult=0x20efd18*=0x218) returned 0x0 [0058.956] RegSetValueExW (in: hKey=0x218, lpValueName="GASAS", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe", cbData=0x4e | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe") returned 0x0 [0058.956] RegCloseKey (hKey=0x218) returned 0x0 [0058.956] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x20efd14 | out: phkResult=0x20efd14*=0x218) returned 0x0 [0058.956] RegSetValueExW (in: hKey=0x218, lpValueName="GASAS", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe", cbData=0x4e | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe") returned 0x0 [0058.956] RegCloseKey (hKey=0x218) returned 0x0 [0058.956] GetProcessHeap () returned 0x580000 [0058.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x118) returned 0x5a7dd0 [0059.044] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\gasas.exe"), bFailIfExists=1) returned 1 [0060.018] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\GASAS.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\gasas.exe"), bFailIfExists=1) returned 1 [0060.043] GetProcessHeap () returned 0x580000 [0060.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7dd0 | out: hHeap=0x580000) returned 1 [0060.043] GetProcessHeap () returned 0x580000 [0060.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6e90 | out: hHeap=0x580000) returned 1 [0060.043] GetProcessHeap () returned 0x580000 [0060.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7788 | out: hHeap=0x580000) returned 1 [0060.043] GetProcessHeap () returned 0x580000 [0060.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a79a0 | out: hHeap=0x580000) returned 1 [0060.044] GetProcessHeap () returned 0x580000 [0060.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7bb8 | out: hHeap=0x580000) returned 1 [0060.044] GetProcessHeap () returned 0x580000 [0060.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59a860 | out: hHeap=0x580000) returned 1 [0060.044] GetProcessHeap () returned 0x580000 [0060.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588e60 | out: hHeap=0x580000) returned 1 [0060.044] GetProcessHeap () returned 0x580000 [0060.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aac58 | out: hHeap=0x580000) returned 1 [0060.044] GetProcessHeap () returned 0x580000 [0060.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6d58 [0060.049] GetProcessHeap () returned 0x580000 [0060.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6bc8 [0060.054] GetProcessHeap () returned 0x580000 [0060.058] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6b00 [0060.165] GetProcessHeap () returned 0x580000 [0060.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x588e60 [0060.170] GetProcessHeap () returned 0x580000 [0060.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588e60 | out: hHeap=0x580000) returned 1 [0060.170] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5a6bc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.170] GetProcessHeap () returned 0x580000 [0060.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b00 | out: hHeap=0x580000) returned 1 [0060.170] GetProcessHeap () returned 0x580000 [0060.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6d58 | out: hHeap=0x580000) returned 1 [0060.170] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20efd34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20efd34*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.170] GetProcessHeap () returned 0x580000 [0060.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6bc8 | out: hHeap=0x580000) returned 1 [0060.170] GetProcessHeap () returned 0x580000 [0060.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x591450 [0060.175] GetProcessHeap () returned 0x580000 [0060.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x587d30 [0060.180] GetProcessHeap () returned 0x580000 [0060.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x60) returned 0x59a860 [0060.185] GetProcessHeap () returned 0x580000 [0060.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x5a) returned 0x588e60 [0060.189] GetProcessHeap () returned 0x580000 [0060.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x588e60, Size=0xb2) returned 0x5a8060 [0060.194] GetProcessHeap () returned 0x580000 [0060.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x58a758 [0060.290] GetProcessHeap () returned 0x580000 [0060.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x180) returned 0x5a6e90 [0060.295] GetProcessHeap () returned 0x580000 [0060.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x250) returned 0x5a7018 [0060.299] GetProcessHeap () returned 0x580000 [0060.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x588e60 [0060.304] GetProcessHeap () returned 0x580000 [0060.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x84) returned 0x5a7788 [0060.309] GetProcessHeap () returned 0x580000 [0060.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x84) returned 0x5a7818 [0060.313] GetProcessHeap () returned 0x580000 [0060.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a78a8 [0060.318] GetProcessHeap () returned 0x580000 [0060.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a78a8 | out: hHeap=0x580000) returned 1 [0060.318] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x5a7788, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0060.318] GetProcessHeap () returned 0x580000 [0060.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7818 | out: hHeap=0x580000) returned 1 [0060.318] GetProcessHeap () returned 0x580000 [0060.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588e60 | out: hHeap=0x580000) returned 1 [0060.318] GetProcessHeap () returned 0x580000 [0060.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc0) returned 0x5a7818 [0060.417] GetProcessHeap () returned 0x580000 [0060.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xb8) returned 0x5a78e0 [0060.423] GetProcessHeap () returned 0x580000 [0060.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb8) returned 0x5a79a0 [0060.427] GetProcessHeap () returned 0x580000 [0060.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x588e60 [0060.443] GetProcessHeap () returned 0x580000 [0060.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x588e60 | out: hHeap=0x580000) returned 1 [0060.443] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x5a78e0, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0060.443] GetProcessHeap () returned 0x580000 [0060.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a79a0 | out: hHeap=0x580000) returned 1 [0060.443] GetProcessHeap () returned 0x580000 [0060.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7818 | out: hHeap=0x580000) returned 1 [0060.443] GetProcessHeap () returned 0x580000 [0060.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a79a0 [0060.448] GetProcessHeap () returned 0x580000 [0060.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a7bb8 [0060.453] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5a7bb8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0060.453] GetProcessHeap () returned 0x580000 [0060.453] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7bb8 | out: hHeap=0x580000) returned 1 [0060.453] GetProcessHeap () returned 0x580000 [0060.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x174) returned 0x5a7bb8 [0060.458] GetProcessHeap () returned 0x580000 [0060.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a7bb8, Size=0x3be) returned 0x5aac58 [0060.618] GetProcessHeap () returned 0x580000 [0060.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x86) returned 0x588e60 [0060.624] GetProcessHeap () returned 0x580000 [0060.628] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x588e60, Size=0x9a) returned 0x588e60 [0060.628] GetProcessHeap () returned 0x580000 [0060.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba) returned 0x5a7818 [0060.634] GetProcessHeap () returned 0x580000 [0060.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a79a0 | out: hHeap=0x580000) returned 1 [0060.634] GetProcessHeap () returned 0x580000 [0060.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6e90 | out: hHeap=0x580000) returned 1 [0060.634] GetProcessHeap () returned 0x580000 [0060.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7018 | out: hHeap=0x580000) returned 1 [0060.634] GetProcessHeap () returned 0x580000 [0060.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7788 | out: hHeap=0x580000) returned 1 [0060.634] GetProcessHeap () returned 0x580000 [0060.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a78e0 | out: hHeap=0x580000) returned 1 [0060.635] GetProcessHeap () returned 0x580000 [0060.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x587d30 | out: hHeap=0x580000) returned 1 [0060.635] GetProcessHeap () returned 0x580000 [0060.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59a860 | out: hHeap=0x580000) returned 1 [0060.635] GetProcessHeap () returned 0x580000 [0060.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6b00 [0060.639] GetProcessHeap () returned 0x580000 [0060.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6b50 [0060.644] GetProcessHeap () returned 0x580000 [0060.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6d30 [0060.650] GetProcessHeap () returned 0x580000 [0060.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6e90 [0060.760] GetProcessHeap () returned 0x580000 [0060.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6e90 | out: hHeap=0x580000) returned 1 [0060.760] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5a6b50, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0060.760] GetProcessHeap () returned 0x580000 [0060.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6d30 | out: hHeap=0x580000) returned 1 [0060.760] GetProcessHeap () returned 0x580000 [0060.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b00 | out: hHeap=0x580000) returned 1 [0060.760] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x20efd34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x20efd34*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0060.760] GetProcessHeap () returned 0x580000 [0060.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b50 | out: hHeap=0x580000) returned 1 [0060.760] GetProcessHeap () returned 0x580000 [0060.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x591420 [0060.765] GetProcessHeap () returned 0x580000 [0060.770] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x58a710 [0060.770] GetProcessHeap () returned 0x580000 [0060.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x60) returned 0x59a860 [0060.775] GetProcessHeap () returned 0x580000 [0060.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x5a) returned 0x5a7788 [0060.779] GetProcessHeap () returned 0x580000 [0060.784] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a7788, Size=0xb2) returned 0x5a6e90 [0060.784] GetProcessHeap () returned 0x580000 [0060.789] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x58a728 [0060.789] GetProcessHeap () returned 0x580000 [0060.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x180) returned 0x5a6f50 [0060.884] GetProcessHeap () returned 0x580000 [0060.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x250) returned 0x5a78e0 [0060.889] GetProcessHeap () returned 0x580000 [0060.893] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a70d8 [0060.893] GetProcessHeap () returned 0x580000 [0060.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x84) returned 0x5a7788 [0060.897] GetProcessHeap () returned 0x580000 [0060.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x84) returned 0x5a7170 [0060.902] GetProcessHeap () returned 0x580000 [0060.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a7200 [0060.906] GetProcessHeap () returned 0x580000 [0060.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7200 | out: hHeap=0x580000) returned 1 [0060.906] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x5a7788, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0060.906] GetProcessHeap () returned 0x580000 [0060.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7170 | out: hHeap=0x580000) returned 1 [0060.906] GetProcessHeap () returned 0x580000 [0060.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a70d8 | out: hHeap=0x580000) returned 1 [0060.906] GetProcessHeap () returned 0x580000 [0060.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc0) returned 0x5a70d8 [0060.910] GetProcessHeap () returned 0x580000 [0060.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xb8) returned 0x5a71a0 [0060.914] GetProcessHeap () returned 0x580000 [0060.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb8) returned 0x5a7b38 [0061.009] GetProcessHeap () returned 0x580000 [0061.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a7bf8 [0061.014] GetProcessHeap () returned 0x580000 [0061.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7bf8 | out: hHeap=0x580000) returned 1 [0061.014] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x5a71a0, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0061.014] GetProcessHeap () returned 0x580000 [0061.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7b38 | out: hHeap=0x580000) returned 1 [0061.014] GetProcessHeap () returned 0x580000 [0061.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a70d8 | out: hHeap=0x580000) returned 1 [0061.014] GetProcessHeap () returned 0x580000 [0061.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5a7b38 [0061.019] GetProcessHeap () returned 0x580000 [0061.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a) returned 0x5ab020 [0061.023] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5ab020, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0061.023] GetProcessHeap () returned 0x580000 [0061.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ab020 | out: hHeap=0x580000) returned 1 [0061.023] GetProcessHeap () returned 0x580000 [0061.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x174) returned 0x5a7d50 [0061.028] GetProcessHeap () returned 0x580000 [0061.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24e) returned 0x5ab020 [0061.032] GetProcessHeap () returned 0x580000 [0061.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x86) returned 0x5a70d8 [0061.036] GetProcessHeap () returned 0x580000 [0061.041] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a70d8, Size=0x9a) returned 0x5a70d8 [0061.041] GetProcessHeap () returned 0x580000 [0061.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba) returned 0x5ab278 [0061.045] GetProcessHeap () returned 0x580000 [0061.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7b38 | out: hHeap=0x580000) returned 1 [0061.045] GetProcessHeap () returned 0x580000 [0061.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0061.045] GetProcessHeap () returned 0x580000 [0061.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a78e0 | out: hHeap=0x580000) returned 1 [0061.045] GetProcessHeap () returned 0x580000 [0061.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7788 | out: hHeap=0x580000) returned 1 [0061.045] GetProcessHeap () returned 0x580000 [0061.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a71a0 | out: hHeap=0x580000) returned 1 [0061.045] GetProcessHeap () returned 0x580000 [0061.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x58a710 | out: hHeap=0x580000) returned 1 [0061.045] GetProcessHeap () returned 0x580000 [0061.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59a860 | out: hHeap=0x580000) returned 1 [0061.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402013, lpParameter=0x20efd60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0061.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401fab, lpParameter=0x20efd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0061.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401e4e, lpParameter=0x20efd7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0061.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401859, lpParameter=0x20efd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0061.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40197c, lpParameter=0x20efd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0061.047] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) Thread: id = 10 os_tid = 0x48c [0061.139] GetCurrentThreadId () returned 0x48c [0061.148] GetVersion () returned 0x23f00206 [0061.148] GetCurrentProcess () returned 0xffffffff [0061.148] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19ff60 | out: TokenHandle=0x19ff60*=0x284) returned 1 [0061.148] GetTokenInformation (in: TokenHandle=0x284, TokenInformationClass=0x14, TokenInformation=0x19ff58, TokenInformationLength=0x4, ReturnLength=0x19ff5c | out: TokenInformation=0x19ff58, ReturnLength=0x19ff5c) returned 1 [0061.148] CloseHandle (hObject=0x284) returned 1 [0061.157] GetProcessHeap () returned 0x580000 [0061.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6d30 [0061.162] GetProcessHeap () returned 0x580000 [0061.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6d80 [0061.450] GetProcessHeap () returned 0x580000 [0061.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6b50 [0061.454] GetProcessHeap () returned 0x580000 [0061.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a7180 [0061.458] GetProcessHeap () returned 0x580000 [0061.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7180 | out: hHeap=0x580000) returned 1 [0061.459] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5a6d80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.459] GetProcessHeap () returned 0x580000 [0061.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b50 | out: hHeap=0x580000) returned 1 [0061.459] GetProcessHeap () returned 0x580000 [0061.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6d30 | out: hHeap=0x580000) returned 1 [0061.459] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.459] GetProcessHeap () returned 0x580000 [0061.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6d80 | out: hHeap=0x580000) returned 1 [0061.459] GetProcessHeap () returned 0x580000 [0061.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x592180 [0061.473] GetProcessHeap () returned 0x580000 [0061.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x592060 [0061.478] GetProcessHeap () returned 0x580000 [0061.482] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x592060, Size=0x72) returned 0x59a860 [0061.482] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0061.482] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x29c [0061.482] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x0) returned 0x0 [0061.482] GetProcessHeap () returned 0x580000 [0061.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x592180 | out: hHeap=0x580000) returned 1 [0061.482] GetProcessHeap () returned 0x580000 [0061.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59a860 | out: hHeap=0x580000) returned 1 [0061.482] ReleaseMutex (hMutex=0x29c) returned 1 [0061.482] CloseHandle (hObject=0x29c) returned 1 [0061.482] Sleep (dwMilliseconds=0x3e8) [0062.667] GetProcessHeap () returned 0x580000 [0062.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6b50 [0062.671] GetProcessHeap () returned 0x580000 [0062.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6c90 [0062.676] GetProcessHeap () returned 0x580000 [0062.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6dd0 [0062.693] GetProcessHeap () returned 0x580000 [0062.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5c3638 [0062.703] GetProcessHeap () returned 0x580000 [0062.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3638 | out: hHeap=0x580000) returned 1 [0062.703] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5a6c90, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.703] GetProcessHeap () returned 0x580000 [0062.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6dd0 | out: hHeap=0x580000) returned 1 [0062.703] GetProcessHeap () returned 0x580000 [0062.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b50 | out: hHeap=0x580000) returned 1 [0062.703] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.703] GetProcessHeap () returned 0x580000 [0062.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6c90 | out: hHeap=0x580000) returned 1 [0062.703] GetProcessHeap () returned 0x580000 [0062.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c3f40 [0062.708] GetProcessHeap () returned 0x580000 [0062.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c3f88 [0062.787] GetProcessHeap () returned 0x580000 [0062.792] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c3f88, Size=0x72) returned 0x59a860 [0062.884] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0062.885] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x2cc [0062.885] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x0 [0062.885] GetProcessHeap () returned 0x580000 [0062.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3f40 | out: hHeap=0x580000) returned 1 [0062.885] GetProcessHeap () returned 0x580000 [0062.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59a860 | out: hHeap=0x580000) returned 1 [0062.885] ReleaseMutex (hMutex=0x2cc) returned 1 [0062.885] CloseHandle (hObject=0x2cc) returned 1 [0062.885] Sleep (dwMilliseconds=0x3e8) [0064.208] GetProcessHeap () returned 0x580000 [0064.212] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x64c878 [0064.213] GetProcessHeap () returned 0x580000 [0064.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x64c8a0 [0064.217] GetProcessHeap () returned 0x580000 [0064.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x64c7b0 [0064.222] GetProcessHeap () returned 0x580000 [0064.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0064.226] GetProcessHeap () returned 0x580000 [0064.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0064.226] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x64c8a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.226] GetProcessHeap () returned 0x580000 [0064.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64c7b0 | out: hHeap=0x580000) returned 1 [0064.226] GetProcessHeap () returned 0x580000 [0064.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64c878 | out: hHeap=0x580000) returned 1 [0064.226] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.226] GetProcessHeap () returned 0x580000 [0064.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64c8a0 | out: hHeap=0x580000) returned 1 [0064.227] GetProcessHeap () returned 0x580000 [0064.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c40f0 [0064.464] GetProcessHeap () returned 0x580000 [0064.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4378 [0064.468] GetProcessHeap () returned 0x580000 [0064.473] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4378, Size=0x72) returned 0x5c3c40 [0064.473] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0064.473] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x354 [0064.473] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x0) returned 0x0 [0064.473] GetProcessHeap () returned 0x580000 [0064.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x580000) returned 1 [0064.473] GetProcessHeap () returned 0x580000 [0064.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0064.473] ReleaseMutex (hMutex=0x354) returned 1 [0064.473] CloseHandle (hObject=0x354) returned 1 [0064.473] Sleep (dwMilliseconds=0x3e8) [0065.918] GetProcessHeap () returned 0x580000 [0065.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf080 [0065.923] GetProcessHeap () returned 0x580000 [0065.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf260 [0065.928] GetProcessHeap () returned 0x580000 [0065.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf210 [0065.932] GetProcessHeap () returned 0x580000 [0065.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0065.936] GetProcessHeap () returned 0x580000 [0065.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0065.936] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf260, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0065.936] GetProcessHeap () returned 0x580000 [0065.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf210 | out: hHeap=0x580000) returned 1 [0065.936] GetProcessHeap () returned 0x580000 [0065.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x580000) returned 1 [0065.937] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0065.937] GetProcessHeap () returned 0x580000 [0065.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf260 | out: hHeap=0x580000) returned 1 [0065.937] GetProcessHeap () returned 0x580000 [0065.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c3eb0 [0065.941] GetProcessHeap () returned 0x580000 [0065.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4408 [0065.946] GetProcessHeap () returned 0x580000 [0065.950] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4408, Size=0x72) returned 0x5c3c40 [0065.950] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0065.950] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x364 [0065.950] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x0 [0065.950] GetProcessHeap () returned 0x580000 [0065.951] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3eb0 | out: hHeap=0x580000) returned 1 [0065.951] GetProcessHeap () returned 0x580000 [0065.951] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0065.951] ReleaseMutex (hMutex=0x364) returned 1 [0065.951] CloseHandle (hObject=0x364) returned 1 [0065.951] Sleep (dwMilliseconds=0x3e8) [0067.280] GetProcessHeap () returned 0x580000 [0067.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf080 [0067.284] GetProcessHeap () returned 0x580000 [0067.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf030 [0067.288] GetProcessHeap () returned 0x580000 [0067.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf120 [0067.293] GetProcessHeap () returned 0x580000 [0067.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0067.297] GetProcessHeap () returned 0x580000 [0067.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0067.297] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf030, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0067.297] GetProcessHeap () returned 0x580000 [0067.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf120 | out: hHeap=0x580000) returned 1 [0067.297] GetProcessHeap () returned 0x580000 [0067.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x580000) returned 1 [0067.297] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0067.297] GetProcessHeap () returned 0x580000 [0067.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf030 | out: hHeap=0x580000) returned 1 [0067.297] GetProcessHeap () returned 0x580000 [0067.301] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4060 [0067.301] GetProcessHeap () returned 0x580000 [0067.306] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4600 [0067.602] GetProcessHeap () returned 0x580000 [0067.607] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4600, Size=0x72) returned 0x5c3c40 [0067.607] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0067.607] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x368 [0067.607] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x0 [0067.607] GetProcessHeap () returned 0x580000 [0067.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4060 | out: hHeap=0x580000) returned 1 [0067.607] GetProcessHeap () returned 0x580000 [0067.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0067.607] ReleaseMutex (hMutex=0x368) returned 1 [0067.607] CloseHandle (hObject=0x368) returned 1 [0067.607] Sleep (dwMilliseconds=0x3e8) [0068.948] GetProcessHeap () returned 0x580000 [0068.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf198 [0068.952] GetProcessHeap () returned 0x580000 [0068.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf148 [0068.957] GetProcessHeap () returned 0x580000 [0068.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf0f8 [0068.968] GetProcessHeap () returned 0x580000 [0068.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0068.973] GetProcessHeap () returned 0x580000 [0068.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0068.973] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf148, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.973] GetProcessHeap () returned 0x580000 [0068.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0f8 | out: hHeap=0x580000) returned 1 [0068.973] GetProcessHeap () returned 0x580000 [0068.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf198 | out: hHeap=0x580000) returned 1 [0068.973] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.973] GetProcessHeap () returned 0x580000 [0068.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf148 | out: hHeap=0x580000) returned 1 [0068.973] GetProcessHeap () returned 0x580000 [0068.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c41c8 [0068.979] GetProcessHeap () returned 0x580000 [0068.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4210 [0068.983] GetProcessHeap () returned 0x580000 [0068.988] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4210, Size=0x72) returned 0x5c3c40 [0068.988] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x334 [0068.988] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0068.988] CloseHandle (hObject=0x334) returned 1 [0068.988] GetProcessHeap () returned 0x580000 [0068.988] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c41c8 | out: hHeap=0x580000) returned 1 [0068.988] GetProcessHeap () returned 0x580000 [0068.988] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0069.168] Sleep (dwMilliseconds=0x3e8) [0070.711] GetProcessHeap () returned 0x580000 [0070.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf1c0 [0070.716] GetProcessHeap () returned 0x580000 [0070.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf238 [0070.721] GetProcessHeap () returned 0x580000 [0070.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf0d0 [0070.725] GetProcessHeap () returned 0x580000 [0070.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0070.729] GetProcessHeap () returned 0x580000 [0070.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0070.730] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf238, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.730] GetProcessHeap () returned 0x580000 [0070.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0070.730] GetProcessHeap () returned 0x580000 [0070.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf1c0 | out: hHeap=0x580000) returned 1 [0070.730] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.730] GetProcessHeap () returned 0x580000 [0070.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf238 | out: hHeap=0x580000) returned 1 [0070.730] GetProcessHeap () returned 0x580000 [0070.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c40f0 [0070.735] GetProcessHeap () returned 0x580000 [0070.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4720 [0070.739] GetProcessHeap () returned 0x580000 [0070.744] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4720, Size=0x72) returned 0x5c3c40 [0070.744] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x360 [0070.744] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x102 [0070.744] CloseHandle (hObject=0x360) returned 1 [0070.744] GetProcessHeap () returned 0x580000 [0070.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c40f0 | out: hHeap=0x580000) returned 1 [0070.744] GetProcessHeap () returned 0x580000 [0070.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0070.982] Sleep (dwMilliseconds=0x3e8) [0072.240] GetProcessHeap () returned 0x580000 [0072.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf1e8 [0072.245] GetProcessHeap () returned 0x580000 [0072.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf2b0 [0072.249] GetProcessHeap () returned 0x580000 [0072.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf030 [0072.254] GetProcessHeap () returned 0x580000 [0072.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0072.360] GetProcessHeap () returned 0x580000 [0072.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0072.360] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf2b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0072.360] GetProcessHeap () returned 0x580000 [0072.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf030 | out: hHeap=0x580000) returned 1 [0072.360] GetProcessHeap () returned 0x580000 [0072.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf1e8 | out: hHeap=0x580000) returned 1 [0072.360] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0072.360] GetProcessHeap () returned 0x580000 [0072.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf2b0 | out: hHeap=0x580000) returned 1 [0072.360] GetProcessHeap () returned 0x580000 [0072.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4450 [0072.365] GetProcessHeap () returned 0x580000 [0072.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c42e8 [0072.369] GetProcessHeap () returned 0x580000 [0072.373] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c42e8, Size=0x72) returned 0x5c3c40 [0072.373] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x310 [0072.373] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0072.374] CloseHandle (hObject=0x310) returned 1 [0072.374] GetProcessHeap () returned 0x580000 [0072.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4450 | out: hHeap=0x580000) returned 1 [0072.374] GetProcessHeap () returned 0x580000 [0072.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0072.382] Sleep (dwMilliseconds=0x3e8) [0073.861] GetProcessHeap () returned 0x580000 [0073.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf080 [0073.866] GetProcessHeap () returned 0x580000 [0073.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf288 [0073.870] GetProcessHeap () returned 0x580000 [0073.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf2b0 [0073.875] GetProcessHeap () returned 0x580000 [0073.879] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb1bf8 [0073.880] GetProcessHeap () returned 0x580000 [0073.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb1bf8 | out: hHeap=0x580000) returned 1 [0073.880] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf288, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.880] GetProcessHeap () returned 0x580000 [0073.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf2b0 | out: hHeap=0x580000) returned 1 [0073.880] GetProcessHeap () returned 0x580000 [0073.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x580000) returned 1 [0073.880] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.880] GetProcessHeap () returned 0x580000 [0073.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0073.880] GetProcessHeap () returned 0x580000 [0073.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4720 [0073.885] GetProcessHeap () returned 0x580000 [0073.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4648 [0074.108] GetProcessHeap () returned 0x580000 [0074.113] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4648, Size=0x72) returned 0x5c3c40 [0074.239] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x338 [0074.239] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0074.239] CloseHandle (hObject=0x338) returned 1 [0074.239] GetProcessHeap () returned 0x580000 [0074.239] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4720 | out: hHeap=0x580000) returned 1 [0074.239] GetProcessHeap () returned 0x580000 [0074.239] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0074.249] Sleep (dwMilliseconds=0x3e8) [0075.394] GetProcessHeap () returned 0x580000 [0075.398] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf030 [0075.398] GetProcessHeap () returned 0x580000 [0075.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf260 [0075.403] GetProcessHeap () returned 0x580000 [0075.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf288 [0075.408] GetProcessHeap () returned 0x580000 [0075.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb1a30 [0075.412] GetProcessHeap () returned 0x580000 [0075.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb1a30 | out: hHeap=0x580000) returned 1 [0075.412] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf260, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0075.412] GetProcessHeap () returned 0x580000 [0075.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0075.412] GetProcessHeap () returned 0x580000 [0075.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf030 | out: hHeap=0x580000) returned 1 [0075.412] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0075.413] GetProcessHeap () returned 0x580000 [0075.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf260 | out: hHeap=0x580000) returned 1 [0075.413] GetProcessHeap () returned 0x580000 [0075.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4720 [0075.417] GetProcessHeap () returned 0x580000 [0075.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4450 [0075.916] GetProcessHeap () returned 0x580000 [0075.921] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4450, Size=0x72) returned 0x1ffb25b8 [0075.921] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x310 [0075.921] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0075.921] CloseHandle (hObject=0x310) returned 1 [0075.921] GetProcessHeap () returned 0x580000 [0075.921] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4720 | out: hHeap=0x580000) returned 1 [0075.922] GetProcessHeap () returned 0x580000 [0075.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb25b8 | out: hHeap=0x580000) returned 1 [0075.930] Sleep (dwMilliseconds=0x3e8) [0077.345] GetProcessHeap () returned 0x580000 [0077.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf030 [0077.349] GetProcessHeap () returned 0x580000 [0077.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf1e8 [0077.353] GetProcessHeap () returned 0x580000 [0077.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf0f8 [0077.358] GetProcessHeap () returned 0x580000 [0077.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb17d0 [0077.362] GetProcessHeap () returned 0x580000 [0077.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb17d0 | out: hHeap=0x580000) returned 1 [0077.362] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf1e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0077.362] GetProcessHeap () returned 0x580000 [0077.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0f8 | out: hHeap=0x580000) returned 1 [0077.362] GetProcessHeap () returned 0x580000 [0077.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf030 | out: hHeap=0x580000) returned 1 [0077.362] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0077.363] GetProcessHeap () returned 0x580000 [0077.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf1e8 | out: hHeap=0x580000) returned 1 [0077.363] GetProcessHeap () returned 0x580000 [0077.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c3f40 [0077.367] GetProcessHeap () returned 0x580000 [0077.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c42a0 [0077.371] GetProcessHeap () returned 0x580000 [0077.376] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c42a0, Size=0x72) returned 0x1ffb2638 [0077.669] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x338 [0077.669] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0077.669] CloseHandle (hObject=0x338) returned 1 [0077.669] GetProcessHeap () returned 0x580000 [0077.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3f40 | out: hHeap=0x580000) returned 1 [0077.669] GetProcessHeap () returned 0x580000 [0077.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2638 | out: hHeap=0x580000) returned 1 [0077.678] Sleep (dwMilliseconds=0x3e8) [0078.992] GetProcessHeap () returned 0x580000 [0078.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf288 [0078.996] GetProcessHeap () returned 0x580000 [0079.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf0d0 [0079.001] GetProcessHeap () returned 0x580000 [0079.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf198 [0079.006] GetProcessHeap () returned 0x580000 [0079.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb13a8 [0079.011] GetProcessHeap () returned 0x580000 [0079.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb13a8 | out: hHeap=0x580000) returned 1 [0079.011] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf0d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.011] GetProcessHeap () returned 0x580000 [0079.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf198 | out: hHeap=0x580000) returned 1 [0079.011] GetProcessHeap () returned 0x580000 [0079.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0079.011] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.011] GetProcessHeap () returned 0x580000 [0079.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0079.011] GetProcessHeap () returned 0x580000 [0079.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c3e68 [0079.016] GetProcessHeap () returned 0x580000 [0079.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4258 [0079.317] GetProcessHeap () returned 0x580000 [0079.317] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4258, Size=0x72) returned 0x1ffb25b8 [0079.317] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x36c [0079.317] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x102 [0079.317] CloseHandle (hObject=0x36c) returned 1 [0079.317] GetProcessHeap () returned 0x580000 [0079.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3e68 | out: hHeap=0x580000) returned 1 [0079.317] GetProcessHeap () returned 0x580000 [0079.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb25b8 | out: hHeap=0x580000) returned 1 [0079.317] Sleep (dwMilliseconds=0x3e8) [0080.498] GetProcessHeap () returned 0x580000 [0080.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf238 [0080.498] GetProcessHeap () returned 0x580000 [0080.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf1e8 [0080.498] GetProcessHeap () returned 0x580000 [0080.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf260 [0080.498] GetProcessHeap () returned 0x580000 [0080.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb1ef0 [0080.498] GetProcessHeap () returned 0x580000 [0080.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb1ef0 | out: hHeap=0x580000) returned 1 [0080.498] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf1e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.498] GetProcessHeap () returned 0x580000 [0080.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf260 | out: hHeap=0x580000) returned 1 [0080.498] GetProcessHeap () returned 0x580000 [0080.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf238 | out: hHeap=0x580000) returned 1 [0080.498] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.498] GetProcessHeap () returned 0x580000 [0080.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf1e8 | out: hHeap=0x580000) returned 1 [0080.499] GetProcessHeap () returned 0x580000 [0080.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4060 [0080.499] GetProcessHeap () returned 0x580000 [0080.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4378 [0080.499] GetProcessHeap () returned 0x580000 [0080.499] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4378, Size=0x72) returned 0x1ffb2cb8 [0080.499] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x3e0 [0080.499] WaitForSingleObject (hHandle=0x3e0, dwMilliseconds=0x0) returned 0x102 [0080.499] CloseHandle (hObject=0x3e0) returned 1 [0080.499] GetProcessHeap () returned 0x580000 [0080.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4060 | out: hHeap=0x580000) returned 1 [0080.499] GetProcessHeap () returned 0x580000 [0080.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2cb8 | out: hHeap=0x580000) returned 1 [0080.499] Sleep (dwMilliseconds=0x3e8) [0081.622] GetProcessHeap () returned 0x580000 [0081.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf2b0 [0081.622] GetProcessHeap () returned 0x580000 [0081.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf0d0 [0081.622] GetProcessHeap () returned 0x580000 [0081.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf0f8 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb1900 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb1900 | out: hHeap=0x580000) returned 1 [0081.623] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf0d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0f8 | out: hHeap=0x580000) returned 1 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf2b0 | out: hHeap=0x580000) returned 1 [0081.623] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4600 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c3f40 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c3f40, Size=0x72) returned 0x1ffb25b8 [0081.623] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x688 [0081.623] WaitForSingleObject (hHandle=0x688, dwMilliseconds=0x0) returned 0x102 [0081.623] CloseHandle (hObject=0x688) returned 1 [0081.624] GetProcessHeap () returned 0x580000 [0081.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4600 | out: hHeap=0x580000) returned 1 [0081.624] GetProcessHeap () returned 0x580000 [0081.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb25b8 | out: hHeap=0x580000) returned 1 [0081.624] Sleep (dwMilliseconds=0x3e8) [0082.783] GetProcessHeap () returned 0x580000 [0082.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf238 [0082.783] GetProcessHeap () returned 0x580000 [0082.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf0d0 [0082.783] GetProcessHeap () returned 0x580000 [0082.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf288 [0082.783] GetProcessHeap () returned 0x580000 [0082.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb1ef0 [0082.783] GetProcessHeap () returned 0x580000 [0082.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb1ef0 | out: hHeap=0x580000) returned 1 [0082.783] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf0d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.783] GetProcessHeap () returned 0x580000 [0082.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0082.783] GetProcessHeap () returned 0x580000 [0082.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf238 | out: hHeap=0x580000) returned 1 [0082.783] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.784] GetProcessHeap () returned 0x580000 [0082.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0082.784] GetProcessHeap () returned 0x580000 [0082.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c41c8 [0082.784] GetProcessHeap () returned 0x580000 [0082.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4330 [0082.784] GetProcessHeap () returned 0x580000 [0082.784] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4330, Size=0x72) returned 0x1ffb2638 [0082.784] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x388 [0082.784] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x102 [0082.784] CloseHandle (hObject=0x388) returned 1 [0082.784] GetProcessHeap () returned 0x580000 [0082.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c41c8 | out: hHeap=0x580000) returned 1 [0082.784] GetProcessHeap () returned 0x580000 [0082.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2638 | out: hHeap=0x580000) returned 1 [0082.784] Sleep (dwMilliseconds=0x3e8) [0083.936] GetProcessHeap () returned 0x580000 [0083.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf2b0 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf238 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf0d0 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb1738 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb1738 | out: hHeap=0x580000) returned 1 [0083.936] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf238, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf2b0 | out: hHeap=0x580000) returned 1 [0083.936] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf238 | out: hHeap=0x580000) returned 1 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4720 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4060 [0083.936] GetProcessHeap () returned 0x580000 [0083.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4060, Size=0x72) returned 0x1ffb2cb8 [0083.936] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x4d4 [0083.936] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0083.937] CloseHandle (hObject=0x4d4) returned 1 [0083.937] GetProcessHeap () returned 0x580000 [0083.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4720 | out: hHeap=0x580000) returned 1 [0083.937] GetProcessHeap () returned 0x580000 [0083.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2cb8 | out: hHeap=0x580000) returned 1 [0083.937] Sleep (dwMilliseconds=0x3e8) [0085.143] GetProcessHeap () returned 0x580000 [0085.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf080 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf0d0 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf0f8 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb17d0 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb17d0 | out: hHeap=0x580000) returned 1 [0085.143] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf0d0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0f8 | out: hHeap=0x580000) returned 1 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x580000) returned 1 [0085.143] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c3eb0 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c40a8 [0085.143] GetProcessHeap () returned 0x580000 [0085.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c40a8, Size=0x72) returned 0x1ffb23b8 [0085.143] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x4c8 [0085.143] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0085.143] CloseHandle (hObject=0x4c8) returned 1 [0085.144] GetProcessHeap () returned 0x580000 [0085.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3eb0 | out: hHeap=0x580000) returned 1 [0085.144] GetProcessHeap () returned 0x580000 [0085.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb23b8 | out: hHeap=0x580000) returned 1 [0085.144] Sleep (dwMilliseconds=0x3e8) [0086.586] GetProcessHeap () returned 0x580000 [0086.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf2b0 [0086.593] GetProcessHeap () returned 0x580000 [0086.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf0f8 [0086.595] GetProcessHeap () returned 0x580000 [0086.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf080 [0086.599] GetProcessHeap () returned 0x580000 [0086.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb1d28 [0086.602] GetProcessHeap () returned 0x580000 [0086.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb1d28 | out: hHeap=0x580000) returned 1 [0086.604] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf0f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0086.607] GetProcessHeap () returned 0x580000 [0086.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x580000) returned 1 [0086.608] GetProcessHeap () returned 0x580000 [0086.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf2b0 | out: hHeap=0x580000) returned 1 [0086.612] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0086.615] GetProcessHeap () returned 0x580000 [0086.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0f8 | out: hHeap=0x580000) returned 1 [0086.621] GetProcessHeap () returned 0x580000 [0086.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c45b8 [0086.621] GetProcessHeap () returned 0x580000 [0086.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c44e0 [0086.621] GetProcessHeap () returned 0x580000 [0086.621] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c44e0, Size=0x72) returned 0x1ffb2838 [0086.621] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x3a4 [0086.622] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0x0) returned 0x102 [0086.622] CloseHandle (hObject=0x3a4) returned 1 [0086.622] GetProcessHeap () returned 0x580000 [0086.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c45b8 | out: hHeap=0x580000) returned 1 [0086.622] GetProcessHeap () returned 0x580000 [0086.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2838 | out: hHeap=0x580000) returned 1 [0086.622] Sleep (dwMilliseconds=0x3e8) [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf0d0 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf288 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf198 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5c03d0 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c03d0 | out: hHeap=0x580000) returned 1 [0087.825] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf288, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf198 | out: hHeap=0x580000) returned 1 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0087.825] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c3e68 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4018 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4018, Size=0x72) returned 0x1ffb2438 [0087.825] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x3d8 [0087.825] WaitForSingleObject (hHandle=0x3d8, dwMilliseconds=0x0) returned 0x102 [0087.825] CloseHandle (hObject=0x3d8) returned 1 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3e68 | out: hHeap=0x580000) returned 1 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2438 | out: hHeap=0x580000) returned 1 [0087.826] Sleep (dwMilliseconds=0x3e8) [0089.105] GetProcessHeap () returned 0x580000 [0089.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf0d0 [0089.105] GetProcessHeap () returned 0x580000 [0089.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf198 [0089.105] GetProcessHeap () returned 0x580000 [0089.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf1e8 [0089.105] GetProcessHeap () returned 0x580000 [0089.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5c0928 [0089.105] GetProcessHeap () returned 0x580000 [0089.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c0928 | out: hHeap=0x580000) returned 1 [0089.105] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf198, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0089.105] GetProcessHeap () returned 0x580000 [0089.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf1e8 | out: hHeap=0x580000) returned 1 [0089.105] GetProcessHeap () returned 0x580000 [0089.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0089.105] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0089.106] GetProcessHeap () returned 0x580000 [0089.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf198 | out: hHeap=0x580000) returned 1 [0089.106] GetProcessHeap () returned 0x580000 [0089.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4720 [0089.106] GetProcessHeap () returned 0x580000 [0089.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c40a8 [0089.106] GetProcessHeap () returned 0x580000 [0089.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c40a8, Size=0x72) returned 0x1ffb23b8 [0089.106] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x51c [0089.106] WaitForSingleObject (hHandle=0x51c, dwMilliseconds=0x0) returned 0x102 [0089.106] CloseHandle (hObject=0x51c) returned 1 [0089.106] GetProcessHeap () returned 0x580000 [0089.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4720 | out: hHeap=0x580000) returned 1 [0089.106] GetProcessHeap () returned 0x580000 [0089.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb23b8 | out: hHeap=0x580000) returned 1 [0089.106] Sleep (dwMilliseconds=0x3e8) [0090.296] GetProcessHeap () returned 0x580000 [0090.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf148 [0090.296] GetProcessHeap () returned 0x580000 [0090.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf080 [0090.296] GetProcessHeap () returned 0x580000 [0090.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf288 [0090.296] GetProcessHeap () returned 0x580000 [0090.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5c0a58 [0090.296] GetProcessHeap () returned 0x580000 [0090.296] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c0a58 | out: hHeap=0x580000) returned 1 [0090.297] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf080, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf148 | out: hHeap=0x580000) returned 1 [0090.297] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x580000) returned 1 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c41c8 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c3f88 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c3f88, Size=0x72) returned 0x1ffb2138 [0090.297] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x6c8 [0090.297] WaitForSingleObject (hHandle=0x6c8, dwMilliseconds=0x0) returned 0x102 [0090.297] CloseHandle (hObject=0x6c8) returned 1 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c41c8 | out: hHeap=0x580000) returned 1 [0090.297] GetProcessHeap () returned 0x580000 [0090.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2138 | out: hHeap=0x580000) returned 1 [0090.297] Sleep (dwMilliseconds=0x3e8) [0091.349] GetProcessHeap () returned 0x580000 [0091.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf288 [0091.351] GetProcessHeap () returned 0x580000 [0091.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf080 [0091.351] GetProcessHeap () returned 0x580000 [0091.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf0d0 [0091.351] GetProcessHeap () returned 0x580000 [0091.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb14d8 [0091.351] GetProcessHeap () returned 0x580000 [0091.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb14d8 | out: hHeap=0x580000) returned 1 [0091.352] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf080, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0091.352] GetProcessHeap () returned 0x580000 [0091.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf0d0 | out: hHeap=0x580000) returned 1 [0091.352] GetProcessHeap () returned 0x580000 [0091.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0091.352] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.371] GetProcessHeap () returned 0x580000 [0091.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x580000) returned 1 [0091.371] GetProcessHeap () returned 0x580000 [0091.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c4720 [0091.371] GetProcessHeap () returned 0x580000 [0091.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4528 [0091.371] GetProcessHeap () returned 0x580000 [0091.371] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4528, Size=0x72) returned 0x1ffb2838 [0091.371] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x4cc [0091.371] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0091.371] CloseHandle (hObject=0x4cc) returned 1 [0091.371] GetProcessHeap () returned 0x580000 [0091.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4720 | out: hHeap=0x580000) returned 1 [0091.371] GetProcessHeap () returned 0x580000 [0091.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2838 | out: hHeap=0x580000) returned 1 [0091.371] Sleep (dwMilliseconds=0x3e8) [0092.671] GetProcessHeap () returned 0x580000 [0092.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf210 [0092.671] GetProcessHeap () returned 0x580000 [0092.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf1e8 [0092.671] GetProcessHeap () returned 0x580000 [0092.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf238 [0092.671] GetProcessHeap () returned 0x580000 [0092.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb11e0 [0092.671] GetProcessHeap () returned 0x580000 [0092.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb11e0 | out: hHeap=0x580000) returned 1 [0092.671] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf1e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0092.671] GetProcessHeap () returned 0x580000 [0092.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf238 | out: hHeap=0x580000) returned 1 [0092.671] GetProcessHeap () returned 0x580000 [0092.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf210 | out: hHeap=0x580000) returned 1 [0092.671] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf1e8 | out: hHeap=0x580000) returned 1 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c42e8 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4528 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4528, Size=0x72) returned 0x1ffb2938 [0092.672] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x4d8 [0092.672] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0092.672] CloseHandle (hObject=0x4d8) returned 1 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c42e8 | out: hHeap=0x580000) returned 1 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2938 | out: hHeap=0x580000) returned 1 [0092.672] Sleep (dwMilliseconds=0x3e8) [0093.773] GetProcessHeap () returned 0x580000 [0093.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5bf260 [0093.775] GetProcessHeap () returned 0x580000 [0093.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5bf120 [0093.938] GetProcessHeap () returned 0x580000 [0093.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5bf288 [0093.938] GetProcessHeap () returned 0x580000 [0093.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x1ffb17d0 [0093.938] GetProcessHeap () returned 0x580000 [0093.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb17d0 | out: hHeap=0x580000) returned 1 [0093.939] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5bf120, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0093.939] GetProcessHeap () returned 0x580000 [0093.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf288 | out: hHeap=0x580000) returned 1 [0093.939] GetProcessHeap () returned 0x580000 [0093.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf260 | out: hHeap=0x580000) returned 1 [0093.939] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0093.996] GetProcessHeap () returned 0x580000 [0093.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bf120 | out: hHeap=0x580000) returned 1 [0093.996] GetProcessHeap () returned 0x580000 [0093.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x5c41c8 [0093.996] GetProcessHeap () returned 0x580000 [0093.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x3a) returned 0x5c4450 [0093.996] GetProcessHeap () returned 0x580000 [0093.996] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c4450, Size=0x72) returned 0x1ffb2cb8 [0093.997] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x4d4 [0093.997] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0093.997] CloseHandle (hObject=0x4d4) returned 1 [0093.997] GetProcessHeap () returned 0x580000 [0093.997] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c41c8 | out: hHeap=0x580000) returned 1 [0093.997] GetProcessHeap () returned 0x580000 [0093.997] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb2cb8 | out: hHeap=0x580000) returned 1 [0093.997] Sleep (dwMilliseconds=0x3e8) Thread: id = 11 os_tid = 0xfa0 [0061.170] GetCurrentThreadId () returned 0xfa0 [0061.179] GetProcessHeap () returned 0x580000 [0061.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x440) returned 0x5ac5a8 [0061.184] GetProcessHeap () returned 0x580000 [0061.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x434) returned 0x5ac9f0 [0061.197] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c [0061.492] Process32FirstW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.492] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.493] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.494] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.494] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.494] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.495] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.495] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.496] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.496] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.497] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.497] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.497] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.498] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.498] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.499] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.499] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.499] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.500] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.500] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.501] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.501] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.501] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.502] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.502] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.503] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.503] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.504] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0061.504] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.504] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0061.505] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0061.505] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0061.506] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.506] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0061.506] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0061.507] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0061.507] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0061.508] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.508] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0061.509] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0061.509] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0061.510] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0061.510] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0061.511] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0061.511] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0061.511] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0061.512] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0061.512] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0061.513] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0061.513] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0061.513] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0061.514] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0061.514] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0061.515] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0061.515] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0061.516] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0061.516] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0061.516] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0061.517] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0061.517] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0061.518] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0061.518] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0061.519] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0061.519] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0061.520] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0061.520] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0061.521] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0061.522] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0061.522] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.523] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.523] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.524] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0061.524] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.745] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0061.746] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.747] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0061.747] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0061.748] Process32NextW (in: hSnapshot=0x29c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0061.748] CloseHandle (hObject=0x29c) returned 1 [0061.748] Sleep (dwMilliseconds=0x1f4) [0062.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b0 [0062.390] Process32FirstW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.391] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.391] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.392] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.392] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.393] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.393] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.393] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.394] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.394] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.395] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0062.395] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0062.396] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.396] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.397] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.397] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.398] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.398] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.399] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.399] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.401] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.402] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.402] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.403] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.403] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.404] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.404] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.405] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0062.405] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.405] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.406] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0062.406] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0062.407] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.407] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0062.408] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0062.408] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0062.409] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0062.409] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.410] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.410] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0062.411] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.411] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0062.412] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0062.412] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0062.412] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0062.413] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0062.413] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0062.414] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0062.414] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0062.415] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0062.549] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0062.549] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0062.549] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0062.550] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0062.550] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0062.551] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0062.551] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0062.552] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0062.552] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0062.553] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0062.554] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0062.554] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0062.555] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0062.555] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0062.556] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0062.557] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0062.558] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0062.558] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0062.559] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.559] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.560] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.561] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0062.561] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.562] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0062.562] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.563] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0062.563] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0062.564] Process32NextW (in: hSnapshot=0x2b0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0062.564] CloseHandle (hObject=0x2b0) returned 1 [0062.564] Sleep (dwMilliseconds=0x1f4) [0063.169] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x308 [0063.177] Process32FirstW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.178] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.178] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.179] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.179] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.180] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.180] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.181] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.181] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.182] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.182] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.182] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.183] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.183] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.184] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.184] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.185] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.185] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.186] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.186] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.187] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.187] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.188] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.188] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.189] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.190] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.191] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.191] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0063.192] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.192] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.193] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0063.193] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0063.194] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.194] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0063.195] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0063.195] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0063.195] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0063.196] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.382] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.383] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0063.383] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.384] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0063.385] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0063.385] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0063.385] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0063.386] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0063.386] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0063.387] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0063.387] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.388] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0063.388] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0063.389] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0063.389] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0063.390] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0063.390] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0063.391] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0063.391] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0063.392] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0063.392] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0063.393] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0063.393] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0063.394] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0063.394] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0063.395] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0063.396] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0063.396] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0063.397] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0063.397] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0063.398] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.399] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.399] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.400] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0063.401] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.401] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0063.402] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.402] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0063.403] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0063.403] Process32NextW (in: hSnapshot=0x308, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0063.404] CloseHandle (hObject=0x308) returned 1 [0063.404] Sleep (dwMilliseconds=0x1f4) [0064.241] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0064.262] Process32FirstW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.263] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.263] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.264] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.264] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.265] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.265] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.265] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.266] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.266] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.267] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0064.267] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0064.268] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.268] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.269] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.269] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.270] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.270] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.270] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.271] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.271] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.272] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.272] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.273] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.273] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.274] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.274] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.484] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0064.485] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.485] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.485] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0064.486] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0064.486] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.487] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0064.487] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0064.488] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0064.488] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0064.489] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.489] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.490] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0064.490] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0064.491] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0064.491] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0064.492] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0064.492] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0064.493] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0064.495] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0064.495] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0064.496] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0064.496] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0064.497] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0064.497] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0064.498] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0064.498] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0064.499] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0064.499] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0064.500] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0064.500] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0064.501] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0064.501] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0064.502] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0064.502] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0064.503] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0064.504] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0064.504] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0064.505] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0064.506] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0064.506] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0064.507] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.507] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.508] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.508] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0064.509] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.510] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0064.510] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.511] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0064.511] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0064.512] Process32NextW (in: hSnapshot=0x328, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0064.512] CloseHandle (hObject=0x328) returned 1 [0064.513] Sleep (dwMilliseconds=0x1f4) [0065.622] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0065.631] Process32FirstW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.632] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.632] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.633] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.633] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.634] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.634] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.635] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.635] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.636] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.636] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0065.637] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0065.637] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.638] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.638] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.639] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.639] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.640] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.640] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.641] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.641] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.642] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.642] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.643] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.643] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.643] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.644] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.644] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0065.645] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.645] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.646] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0065.646] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0065.647] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.647] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0065.648] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0065.648] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0065.649] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0066.045] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.046] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.046] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0066.047] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.047] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0066.048] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0066.048] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0066.049] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0066.049] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0066.050] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0066.050] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0066.051] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0066.051] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0066.051] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0066.052] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0066.052] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0066.053] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0066.053] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0066.054] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0066.054] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0066.055] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0066.055] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0066.056] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0066.056] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0066.057] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0066.058] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0066.058] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0066.059] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0066.059] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0066.060] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0066.061] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0066.061] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.062] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.062] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.063] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0066.063] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.064] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0066.064] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.065] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0066.065] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0066.066] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0066.066] CloseHandle (hObject=0x310) returned 1 [0066.066] Sleep (dwMilliseconds=0x1f4) [0066.902] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0066.907] Process32FirstW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.907] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.908] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.908] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.908] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.909] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.909] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.910] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.910] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.910] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.911] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0066.911] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0066.912] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.912] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.913] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.913] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.913] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.914] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.914] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.915] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.915] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.916] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.916] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.916] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.917] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.917] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.918] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.918] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0066.918] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.919] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.919] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0066.920] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0066.920] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.921] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0066.921] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0066.921] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0066.922] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0066.922] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.923] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.923] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0066.923] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0066.924] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0066.924] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0066.925] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0066.925] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0066.926] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0066.926] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0066.926] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0066.927] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0066.927] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0066.928] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0066.928] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0066.929] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0066.929] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0067.259] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0067.259] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0067.260] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0067.260] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0067.261] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0067.261] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0067.262] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0067.262] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0067.263] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0067.263] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0067.264] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0067.264] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0067.265] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0067.265] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0067.266] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.267] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.267] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.268] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0067.268] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.269] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0067.269] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.269] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0067.270] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0067.270] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0067.271] CloseHandle (hObject=0x360) returned 1 [0067.271] Sleep (dwMilliseconds=0x1f4) [0068.091] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0068.095] Process32FirstW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.096] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0068.096] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0068.097] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.097] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0068.097] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.098] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0068.099] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0068.099] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0068.100] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.100] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0068.100] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0068.101] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.101] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0068.102] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.102] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.103] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.103] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.104] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.104] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.105] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.105] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.106] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.106] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0068.107] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.107] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.107] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0068.108] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0068.108] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.109] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0068.109] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0068.110] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0068.110] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0068.111] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0068.111] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0068.112] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0068.112] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0068.112] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.113] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0068.113] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0068.114] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0068.114] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0068.115] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0068.115] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0068.116] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0068.116] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0068.116] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0068.117] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0068.118] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0068.118] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0068.118] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0068.285] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0068.285] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0068.285] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0068.286] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0068.286] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0068.287] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0068.287] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0068.288] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0068.288] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0068.292] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0068.292] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0068.293] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0068.293] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0068.294] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0068.295] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0068.295] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0068.296] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0068.296] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.297] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.297] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.298] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0068.298] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.299] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0068.300] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.300] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0068.300] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0068.301] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0068.302] CloseHandle (hObject=0x360) returned 1 [0068.302] Sleep (dwMilliseconds=0x1f4) [0069.230] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0069.234] Process32FirstW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.235] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.235] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.236] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.236] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.237] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.237] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.238] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.238] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.238] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.239] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.239] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.240] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.240] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.241] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.241] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.242] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.242] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.243] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.243] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.244] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.244] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.244] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.245] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.245] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.246] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.246] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.247] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0069.247] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.248] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.248] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0069.248] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0069.249] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.249] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0069.250] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0069.250] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0069.251] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0069.251] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.252] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.252] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0069.253] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.253] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0069.253] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0069.254] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0069.254] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0069.255] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0069.255] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0069.256] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0069.256] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0069.257] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0069.257] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0069.257] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0069.512] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0069.512] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0069.513] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0069.513] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0069.514] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0069.514] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0069.515] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0069.515] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0069.516] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0069.516] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0069.517] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0069.518] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0069.518] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0069.519] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0069.519] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0069.520] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0069.520] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.521] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.521] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.522] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0069.523] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.523] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0069.536] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.536] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0069.537] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0069.537] Process32NextW (in: hSnapshot=0x33c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0069.538] CloseHandle (hObject=0x33c) returned 1 [0069.538] Sleep (dwMilliseconds=0x1f4) [0070.767] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0070.772] Process32FirstW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.772] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.773] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.773] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.774] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.774] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.774] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.775] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.775] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.776] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.776] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0070.777] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0070.777] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.778] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.778] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.779] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.779] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.779] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.780] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.780] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.781] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.781] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.782] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.782] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.783] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.783] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.783] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.784] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0070.784] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.785] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.785] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0070.786] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0070.786] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.787] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0070.787] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0070.787] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0070.788] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0070.788] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.789] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.789] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0070.790] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0070.790] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0070.791] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0070.791] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0070.791] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0070.792] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0070.792] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0070.793] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0070.793] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0070.794] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0070.794] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0070.795] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0070.795] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0070.796] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0070.796] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0070.797] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0070.797] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0070.797] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0070.982] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0070.983] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0070.983] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0070.984] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0070.985] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0070.985] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0070.986] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0070.986] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0070.987] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0070.988] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0070.988] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.989] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.989] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.990] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0070.990] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.991] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0070.991] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.992] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0070.992] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0070.993] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0070.993] CloseHandle (hObject=0x360) returned 1 [0070.993] Sleep (dwMilliseconds=0x1f4) [0071.672] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0071.676] Process32FirstW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.677] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.677] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.678] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.678] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.679] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.679] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.680] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.680] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.681] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.681] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0071.682] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0071.682] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.683] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.683] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.683] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.684] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.684] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.685] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.685] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.686] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.686] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.687] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.687] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.688] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.688] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.689] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.689] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0071.689] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.690] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.690] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0071.691] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0071.691] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.692] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0071.692] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0071.693] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0071.693] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0071.694] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.694] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.062] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0072.062] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.063] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0072.063] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0072.063] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0072.064] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0072.064] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0072.065] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0072.065] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0072.066] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0072.066] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0072.067] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0072.067] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0072.068] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0072.068] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0072.068] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0072.069] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0072.069] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0072.070] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0072.070] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0072.071] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0072.071] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0072.072] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0072.072] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0072.073] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0072.074] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0072.074] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0072.075] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0072.075] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0072.076] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.077] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.077] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.078] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0072.078] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.079] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0072.079] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.080] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0072.080] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0072.081] Process32NextW (in: hSnapshot=0x310, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0072.081] CloseHandle (hObject=0x310) returned 1 [0072.081] Sleep (dwMilliseconds=0x1f4) [0072.806] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0072.811] Process32FirstW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.811] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.812] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.812] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.812] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.813] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.813] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.814] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.814] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.815] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.815] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0072.815] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0072.816] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.816] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.817] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.817] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.818] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.818] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.818] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.819] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.819] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.820] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.820] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.821] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.824] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.824] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.824] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.825] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0072.825] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.826] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.826] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0072.827] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0072.827] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.828] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0072.828] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0072.828] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0072.829] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0072.829] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.830] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.830] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0072.830] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.831] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0072.831] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0072.832] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0072.832] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0072.833] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0072.833] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0072.833] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0072.834] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0072.834] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0072.835] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0072.907] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0072.908] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0072.908] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0072.908] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0072.909] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0072.909] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0072.910] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0072.910] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0072.911] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0072.911] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0072.912] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0072.912] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0072.913] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0072.914] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0072.914] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0072.915] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0072.915] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0072.916] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.916] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.917] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.917] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0072.918] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.918] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0072.919] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.920] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0072.920] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0072.921] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0072.921] CloseHandle (hObject=0x30c) returned 1 [0072.921] Sleep (dwMilliseconds=0x1f4) [0073.814] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0073.819] Process32FirstW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.819] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.819] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.820] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.820] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.821] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.821] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.822] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.822] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.823] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.823] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.824] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.824] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.824] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.825] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.825] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.826] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.826] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.827] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.827] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.828] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.828] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.829] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.829] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.829] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.830] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.830] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.831] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0073.831] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.832] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.832] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0073.833] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0073.833] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.834] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0073.834] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0073.834] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0073.835] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0073.835] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.836] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.836] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0073.837] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.837] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0073.838] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0073.838] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0073.839] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0073.839] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0073.840] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0073.840] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0073.840] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0073.841] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0073.841] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0074.093] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0074.094] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0074.094] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0074.094] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0074.095] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0074.095] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0074.096] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0074.096] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0074.097] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0074.098] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0074.098] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0074.099] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0074.099] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0074.100] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0074.100] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0074.101] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0074.102] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0074.102] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.103] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.103] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.104] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0074.105] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.105] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0074.106] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.106] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0074.107] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0074.108] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0074.108] CloseHandle (hObject=0x30c) returned 1 [0074.108] Sleep (dwMilliseconds=0x1f4) [0074.866] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0074.870] Process32FirstW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.871] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0074.872] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0074.872] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.872] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0074.873] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.873] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0074.874] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0074.874] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0074.875] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.875] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0074.876] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0074.876] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.877] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0074.877] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.878] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.878] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.879] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.879] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.879] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.880] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.880] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.881] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.881] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0074.882] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.882] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.883] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0074.883] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0074.884] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.884] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.885] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0074.885] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0074.886] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0074.886] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0074.886] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0074.887] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0074.887] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0074.888] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.889] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.889] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0074.890] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0074.890] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0074.890] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0074.891] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0074.891] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0074.892] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0074.892] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0074.893] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0074.893] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0074.894] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0074.894] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0074.895] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0074.895] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0074.896] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0074.896] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0074.896] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0075.122] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0075.170] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0075.171] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0075.171] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0075.172] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0075.173] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0075.173] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0075.174] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0075.174] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0075.175] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0075.175] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0075.176] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0075.177] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.177] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.178] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.178] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0075.179] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.179] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0075.180] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.180] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0075.181] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0075.182] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0075.182] CloseHandle (hObject=0x360) returned 1 [0075.182] Sleep (dwMilliseconds=0x1f4) [0076.119] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0076.125] Process32FirstW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.125] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.126] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0076.126] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.127] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0076.127] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.127] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0076.128] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0076.128] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0076.129] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.129] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0076.130] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0076.130] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.131] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0076.131] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.131] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.132] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.132] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.133] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.133] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.134] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.134] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.135] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.135] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0076.135] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.136] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.136] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0076.137] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0076.137] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.138] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.138] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0076.138] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0076.139] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0076.139] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0076.140] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0076.140] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0076.141] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0076.141] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.141] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.142] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0076.142] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0076.143] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0076.143] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0076.144] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0076.144] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0076.144] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0076.145] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0076.145] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0076.146] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0076.146] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0076.375] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0076.376] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0076.376] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0076.377] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0076.377] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0076.378] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0076.378] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0076.378] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0076.379] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0076.379] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0076.380] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0076.381] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0076.381] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0076.382] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0076.383] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0076.383] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0076.384] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0076.384] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0076.385] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.385] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.386] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.386] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0076.387] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.388] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0076.388] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.389] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0076.389] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0076.389] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0076.390] CloseHandle (hObject=0x30c) returned 1 [0076.390] Sleep (dwMilliseconds=0x1f4) [0077.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0077.315] Process32FirstW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.316] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.316] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.316] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.317] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.317] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.318] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.318] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.318] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.319] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.319] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.320] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.320] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.322] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.322] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.323] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.323] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.324] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.325] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.325] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.325] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.326] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.327] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.327] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.328] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.328] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.329] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.329] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0077.330] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.330] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.331] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0077.332] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0077.332] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.333] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0077.333] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0077.334] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0077.334] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0077.648] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.648] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.649] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0077.649] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0077.650] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0077.650] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0077.651] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0077.651] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0077.652] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0077.652] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0077.653] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0077.653] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0077.653] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0077.654] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0077.654] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0077.655] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0077.655] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0077.656] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0077.656] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0077.657] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0077.657] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0077.658] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0077.658] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0077.659] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0077.659] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0077.660] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0077.661] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0077.661] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0077.662] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0077.662] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0077.663] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.663] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.664] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.665] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0077.665] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.666] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0077.666] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.667] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0077.667] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0077.668] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0077.668] Process32NextW (in: hSnapshot=0x338, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0077.669] CloseHandle (hObject=0x338) returned 1 [0077.669] Sleep (dwMilliseconds=0x1f4) [0078.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x360 [0078.540] Process32FirstW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0078.540] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0078.540] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0078.541] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.541] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0078.542] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0078.542] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0078.543] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0078.543] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0078.543] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.544] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0078.544] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0078.545] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.545] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0078.546] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.546] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.546] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.547] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.547] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.548] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.548] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.549] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.549] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.550] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0078.550] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.550] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.551] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0078.551] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0078.552] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.552] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.847] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0078.848] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0078.848] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0078.849] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0078.849] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0078.850] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0078.850] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0078.851] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.851] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0078.851] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0078.852] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0078.853] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0078.853] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0078.853] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0078.854] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0078.854] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0078.855] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0078.855] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0078.856] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0078.856] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0078.857] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0078.857] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0078.857] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0078.858] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0078.858] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0078.859] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0078.859] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0078.860] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0078.861] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0078.861] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0078.862] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0078.862] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0078.863] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0078.864] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0078.864] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0078.865] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0078.865] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0078.866] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.867] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.867] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.868] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0078.868] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.869] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0078.869] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.870] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0078.870] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0078.871] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0078.871] Process32NextW (in: hSnapshot=0x360, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0078.872] CloseHandle (hObject=0x360) returned 1 [0078.872] Sleep (dwMilliseconds=0x1f4) [0079.851] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0079.872] Process32FirstW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.872] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.873] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.873] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.874] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.874] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.875] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.875] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.876] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.876] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0079.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0079.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.878] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.878] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.879] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.879] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.880] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.880] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.881] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.881] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.882] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.882] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.883] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.883] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.884] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.884] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.885] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0079.885] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.886] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0079.886] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0079.886] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0079.887] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.887] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0079.888] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0079.888] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0079.889] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0079.889] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0079.890] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0079.890] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0079.891] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0079.891] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0079.892] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0079.892] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0079.893] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0079.893] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0079.893] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0079.894] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0079.895] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0079.895] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0079.896] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0079.896] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0079.896] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0080.087] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0080.090] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0080.103] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0080.105] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0080.111] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0080.117] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0080.118] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0080.118] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0080.119] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0080.120] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0080.120] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0080.121] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0080.122] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0080.122] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0080.123] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.123] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.124] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.124] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0080.125] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.126] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0080.126] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.127] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0080.127] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0080.128] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0080.128] Process32NextW (in: hSnapshot=0x38c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0080.129] CloseHandle (hObject=0x38c) returned 1 [0080.129] Sleep (dwMilliseconds=0x1f4) [0080.929] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c [0080.937] Process32FirstW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0080.937] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0080.938] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0080.938] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.939] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0080.939] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0080.940] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0080.940] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0080.941] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0080.941] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.942] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0080.942] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0080.943] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.943] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0080.944] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.944] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.945] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.945] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.945] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.946] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.946] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.947] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.947] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.948] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0080.948] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.949] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.949] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0080.949] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0080.950] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.950] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.951] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0080.951] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0080.952] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0080.952] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0080.953] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0080.953] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0080.953] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0080.954] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.954] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.955] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0080.955] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0080.956] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0080.956] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0080.957] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0080.957] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0080.957] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0080.958] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0080.958] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0080.959] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0080.959] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0080.960] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0080.960] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0080.961] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0080.961] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0080.961] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0080.962] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0080.962] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0080.963] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0081.254] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0081.265] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0081.268] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0081.286] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0081.288] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0081.289] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0081.289] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0081.290] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0081.290] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0081.291] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.292] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.292] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.293] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0081.293] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.294] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0081.295] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.295] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0081.296] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0081.296] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0081.297] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0081.297] CloseHandle (hObject=0x51c) returned 1 [0081.297] Sleep (dwMilliseconds=0x1f4) [0082.595] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0082.601] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.601] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0082.601] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0082.602] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.602] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0082.603] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.604] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0082.604] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0082.605] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0082.605] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.606] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0082.606] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0082.607] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.607] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0082.607] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.608] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.608] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.609] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.609] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.610] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.610] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.611] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.611] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.611] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0082.612] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.612] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.614] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0082.615] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0082.615] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.616] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0082.616] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0082.617] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0082.617] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0082.618] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0082.618] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0082.619] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0082.619] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0082.619] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0082.620] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0082.620] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0082.621] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0082.621] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0082.622] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0082.622] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0082.623] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0082.623] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0082.623] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0082.624] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0082.624] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0082.625] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0082.625] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0082.626] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0082.626] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0082.627] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0082.627] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0082.628] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0082.628] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0082.785] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0082.789] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0082.789] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0082.790] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0082.790] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0082.791] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0082.791] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0082.792] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0082.792] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0082.793] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0082.794] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0082.794] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0082.795] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.795] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0082.796] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0082.796] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0082.797] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.797] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0082.799] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0082.800] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0082.800] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0082.801] CloseHandle (hObject=0x4c4) returned 1 [0082.801] Sleep (dwMilliseconds=0x1f4) [0083.543] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0083.633] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.634] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0083.634] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0083.635] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.635] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0083.636] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.636] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0083.637] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0083.637] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0083.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0083.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0083.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0083.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.641] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.641] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.642] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.642] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.643] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.643] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.644] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.645] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0083.645] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.646] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.646] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0083.647] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0083.647] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.647] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0083.648] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0083.648] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0083.649] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0083.649] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0083.650] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0083.650] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0083.651] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0083.651] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0083.652] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0083.652] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0083.653] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0083.653] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0083.654] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0083.654] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0083.654] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0083.655] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0083.655] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0083.656] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0083.656] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0083.657] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0083.657] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0083.658] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0083.658] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0083.659] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0083.659] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0083.660] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0083.660] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0083.661] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0083.661] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0083.662] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0083.662] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0083.663] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0083.664] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0083.664] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0083.665] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0083.666] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0083.666] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0083.667] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.667] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.668] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.668] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0083.669] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.670] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0083.670] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.671] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0083.671] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0083.672] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0083.672] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0083.673] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0083.673] CloseHandle (hObject=0x3d0) returned 1 [0083.673] Sleep (dwMilliseconds=0x1f4) [0084.260] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0084.396] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.396] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0084.397] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0084.397] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.398] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0084.398] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.399] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0084.399] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0084.400] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0084.400] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.401] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0084.401] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0084.401] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.402] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0084.402] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.403] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.403] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.404] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.404] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.405] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.405] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.406] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.406] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.407] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0084.407] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.407] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.408] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0084.408] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0084.409] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.409] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0084.410] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0084.411] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0084.411] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0084.412] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0084.412] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0084.412] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0084.413] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0084.413] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.414] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0084.414] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0084.415] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0084.415] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0084.416] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0084.416] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0084.417] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0084.417] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0084.418] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0084.418] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0084.419] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0084.419] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0084.419] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0084.420] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0084.420] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0084.421] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0084.421] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0084.422] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0084.422] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0084.423] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0084.423] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0084.424] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0084.424] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0084.425] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0084.425] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0084.633] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0084.633] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0084.634] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0084.634] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0084.635] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.636] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.636] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.637] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0084.637] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0084.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0084.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0084.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0084.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0084.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0084.641] CloseHandle (hObject=0x3d0) returned 1 [0084.641] Sleep (dwMilliseconds=0x1f4) [0085.350] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0085.365] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.366] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0085.366] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0085.366] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.367] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0085.367] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.368] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0085.368] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0085.369] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0085.369] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.370] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0085.370] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0085.370] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.371] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0085.371] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.372] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.372] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.373] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.373] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.374] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.374] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.374] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.375] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.375] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0085.376] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.376] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.377] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0085.377] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0085.377] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.378] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0085.378] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0085.379] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0085.380] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0085.380] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0085.380] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0085.381] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0085.381] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0085.382] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0085.382] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0085.383] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0085.383] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0085.383] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0085.384] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0085.384] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0085.385] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0085.385] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0085.386] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0085.386] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0085.387] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0085.387] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0085.387] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0085.388] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0085.388] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0085.389] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0085.389] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0085.390] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0085.390] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0085.390] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0085.391] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0085.392] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0085.392] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0085.393] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0085.393] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0085.394] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0085.566] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0085.567] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0085.567] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0085.568] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.568] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.569] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.570] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0085.570] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.571] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0085.571] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.572] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0085.572] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0085.573] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0085.573] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0085.574] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0085.574] CloseHandle (hObject=0x3d0) returned 1 [0085.574] Sleep (dwMilliseconds=0x1f4) [0086.332] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x30c [0086.352] Process32FirstW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.353] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0086.353] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0086.354] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.354] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0086.355] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.355] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0086.356] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0086.356] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0086.356] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.357] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0086.357] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0086.358] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.358] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0086.359] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.359] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.359] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.360] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.360] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.361] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.361] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.362] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.362] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.362] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0086.363] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.363] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.364] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0086.364] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0086.365] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.365] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0086.366] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0086.366] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0086.366] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0086.367] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0086.367] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0086.368] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0086.368] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0086.369] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.369] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0086.370] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0086.370] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0086.370] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0086.371] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0086.371] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0086.372] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0086.372] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0086.373] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0086.373] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0086.373] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0086.374] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0086.374] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0086.375] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0086.375] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0086.376] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0086.376] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0086.377] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0086.377] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0086.377] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0086.378] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0086.378] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0086.379] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0086.729] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0086.729] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0086.730] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0086.731] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0086.731] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0086.732] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0086.732] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.733] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.733] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.734] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0086.734] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.735] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0086.735] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.736] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0086.736] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0086.737] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0086.737] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0086.738] Process32NextW (in: hSnapshot=0x30c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0086.738] CloseHandle (hObject=0x30c) returned 1 [0086.738] Sleep (dwMilliseconds=0x1f4) [0087.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0087.388] Process32FirstW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.388] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0087.389] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0087.389] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.389] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0087.390] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.390] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0087.391] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0087.391] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0087.392] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.392] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0087.392] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0087.393] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.393] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0087.394] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.394] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.394] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.395] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.395] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.396] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.396] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.397] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.397] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.397] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0087.398] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.398] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.399] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0087.399] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0087.400] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.400] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0087.400] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0087.401] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0087.401] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0087.402] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0087.402] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0087.402] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0087.403] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0087.403] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0087.404] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0087.404] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0087.405] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0087.405] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0087.405] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0087.406] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0087.406] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0087.407] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0087.407] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0087.407] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0087.408] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0087.408] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0087.409] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0087.409] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0087.409] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0087.410] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0087.410] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0087.411] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0087.412] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0087.413] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0087.413] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0087.414] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0087.414] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0087.415] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0087.415] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0087.416] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0087.416] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0087.417] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0087.417] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0087.418] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0087.419] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0087.419] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.420] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0087.420] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0087.421] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0087.421] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.422] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0087.422] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0087.422] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0087.423] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0087.423] Process32NextW (in: hSnapshot=0x36c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0087.424] CloseHandle (hObject=0x36c) returned 1 [0087.424] Sleep (dwMilliseconds=0x1f4) [0088.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c [0088.301] Process32FirstW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.302] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.302] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.303] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.303] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.304] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.304] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.305] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.305] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.306] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.306] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.307] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0088.307] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.308] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.308] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.308] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.309] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.309] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.310] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.310] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.311] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.311] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.312] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.312] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.313] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.313] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.313] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.314] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0088.314] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.315] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.315] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0088.316] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0088.316] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.317] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0088.317] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0088.318] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0088.318] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0088.319] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.319] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.320] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0088.320] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0088.320] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0088.321] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0088.321] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0088.322] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0088.322] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0088.323] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0088.323] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0088.324] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0088.324] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0088.324] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0088.325] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0088.325] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0088.326] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0088.326] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0088.327] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0088.327] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0088.327] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0088.328] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0088.328] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0088.329] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0088.330] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0088.330] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0088.331] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0088.537] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0088.538] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0088.538] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0088.539] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.539] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.540] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.540] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0088.541] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.542] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0088.542] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.543] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0088.543] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0088.544] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0088.544] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0088.545] Process32NextW (in: hSnapshot=0x51c, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0088.545] CloseHandle (hObject=0x51c) returned 1 [0088.545] Sleep (dwMilliseconds=0x1f4) [0089.213] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0089.218] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.218] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.219] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.219] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.219] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.220] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.220] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.221] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.221] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.222] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.222] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0089.222] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0089.223] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.223] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.224] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.224] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.225] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.225] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.225] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.226] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.226] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.227] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.227] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.227] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.228] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.229] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.229] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.230] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0089.230] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.231] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0089.231] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0089.231] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0089.232] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.232] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0089.233] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0089.233] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0089.234] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0089.234] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0089.235] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0089.235] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0089.235] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0089.236] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0089.236] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0089.237] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0089.237] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0089.238] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0089.238] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0089.239] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0089.239] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0089.239] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0089.240] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0089.240] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0089.241] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0089.241] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0089.242] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0089.242] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0089.242] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0089.243] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0089.243] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0089.244] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0089.245] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0089.366] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0089.367] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0089.367] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0089.368] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0089.369] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0089.369] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0089.370] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.370] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.371] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.371] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0089.372] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.372] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0089.373] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.374] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0089.374] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0089.375] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0089.375] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0089.376] Process32NextW (in: hSnapshot=0x3d0, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0089.376] CloseHandle (hObject=0x3d0) returned 1 [0089.376] Sleep (dwMilliseconds=0x1f4) [0090.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4c4 [0090.009] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.034] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0090.034] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0090.035] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.035] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0090.036] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.036] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0090.037] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0090.037] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0090.037] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.038] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0090.038] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0090.039] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.039] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0090.040] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.040] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.040] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.047] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.048] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.048] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.048] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.049] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.049] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.050] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0090.050] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.051] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.051] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0090.051] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0090.052] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.052] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0090.053] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0090.053] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0090.054] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0090.054] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0090.054] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0090.055] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0090.055] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0090.056] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0090.056] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0090.057] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0090.057] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0090.058] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0090.058] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0090.059] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0090.059] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0090.059] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0090.060] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0090.060] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0090.061] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0090.061] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0090.062] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0090.062] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0090.062] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0090.063] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0090.063] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0090.064] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0090.064] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0090.064] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0090.065] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0090.066] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0090.066] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0090.067] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0090.067] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0090.068] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0090.068] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0090.069] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0090.069] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0090.070] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.238] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.239] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.239] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0090.240] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0090.240] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0090.241] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.241] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0090.242] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0090.242] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0090.243] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0090.243] Process32NextW (in: hSnapshot=0x4c4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0090.244] CloseHandle (hObject=0x4c4) returned 1 [0090.244] Sleep (dwMilliseconds=0x1f4) [0090.838] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4cc [0090.843] Process32FirstW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.844] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0090.844] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0090.845] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.845] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0090.846] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.846] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0090.846] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0090.847] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0090.847] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.848] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0090.848] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0090.849] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.849] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0090.850] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.850] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.851] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.851] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.851] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.852] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.852] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.853] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.853] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.854] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0090.854] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.855] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.855] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0090.856] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0090.856] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.857] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0090.857] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0090.858] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0090.858] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0090.859] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0090.859] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0090.859] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0090.860] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0090.860] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0090.861] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0090.861] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0090.862] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0090.862] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0090.863] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0090.863] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0090.864] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0090.864] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0090.864] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0090.865] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0090.865] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0090.866] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0090.866] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0090.867] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0090.867] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0090.868] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0090.868] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0090.868] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0090.869] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0090.869] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0090.870] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0090.870] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0090.871] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0090.872] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0090.872] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0090.873] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0090.873] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0090.874] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0091.093] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0091.094] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.094] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.095] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.095] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0091.096] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.096] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0091.097] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.098] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0091.098] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0091.099] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0091.099] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0091.100] Process32NextW (in: hSnapshot=0x4cc, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0091.100] CloseHandle (hObject=0x4cc) returned 1 [0091.100] Sleep (dwMilliseconds=0x1f4) [0091.791] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4d4 [0091.796] Process32FirstW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.796] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.797] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.797] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.798] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.798] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.799] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.799] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.800] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.800] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.800] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.801] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.801] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.802] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.802] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.803] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.803] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.804] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.804] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.804] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.805] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.805] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.806] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.806] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.807] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.807] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.808] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.808] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0091.809] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.809] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.809] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0091.810] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0091.810] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.811] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0091.811] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0091.812] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0091.812] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0091.813] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.813] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0091.814] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0091.814] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0091.815] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0091.815] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0091.816] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0091.816] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0091.816] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0091.817] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0091.817] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0091.818] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0091.818] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0091.819] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0091.819] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0091.820] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0091.820] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0091.821] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0091.821] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0091.821] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0091.822] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0091.823] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0091.823] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0091.824] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0091.824] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0091.825] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0091.826] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0091.826] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0091.827] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0091.827] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0091.863] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.867] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.868] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.868] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0091.869] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.870] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0091.870] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.871] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0091.871] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0091.872] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0091.872] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0091.873] Process32NextW (in: hSnapshot=0x4d4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0091.873] CloseHandle (hObject=0x4d4) returned 1 [0091.873] Sleep (dwMilliseconds=0x1f4) [0092.620] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0092.630] Process32FirstW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.631] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0092.631] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0092.632] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.632] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0092.632] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.633] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0092.633] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0092.634] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0092.634] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.635] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0092.635] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0092.646] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.647] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0092.647] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.647] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.648] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.648] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.649] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.649] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.650] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.650] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.651] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.651] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0092.652] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.652] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.653] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0092.653] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0092.654] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.654] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.655] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0092.655] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0092.656] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0092.656] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0092.656] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0092.657] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0092.657] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0092.658] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.658] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.659] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0092.659] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0092.659] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0092.660] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0092.660] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0092.661] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0092.661] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0092.662] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0092.662] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0092.662] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0092.663] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0092.663] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0092.664] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0092.664] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0092.664] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0092.665] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0092.665] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0092.666] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0092.666] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0092.667] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0092.667] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0092.668] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0092.668] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0092.669] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0092.870] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0092.871] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0092.871] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0092.872] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0092.872] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.873] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.873] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.874] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0092.874] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.875] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0092.875] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.876] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0092.876] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0092.877] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0092.877] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0092.878] Process32NextW (in: hSnapshot=0x254, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0092.878] CloseHandle (hObject=0x254) returned 1 [0092.878] Sleep (dwMilliseconds=0x1f4) [0093.470] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b4 [0093.477] Process32FirstW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.477] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.478] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.478] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.479] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.479] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.480] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.480] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.480] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.481] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.481] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.482] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.482] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.483] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.483] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x60, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.484] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.484] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.485] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.485] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.485] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.486] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.486] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.487] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.487] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.488] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.488] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.489] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.489] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0093.489] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.490] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.490] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0093.491] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0093.491] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.492] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0093.492] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0093.493] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0093.493] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0093.493] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.494] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.494] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0093.495] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0093.496] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0093.496] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0093.496] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0093.497] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0093.497] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0093.498] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0093.498] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0093.499] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0093.499] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0093.500] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0093.500] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0093.501] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0093.501] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0093.501] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0093.502] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0093.502] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0093.503] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0093.568] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0093.581] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0093.583] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0093.597] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0093.598] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0093.612] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0093.613] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0093.627] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0093.628] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0093.667] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.668] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.668] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.669] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0093.670] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.670] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0093.671] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.671] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0093.672] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0093.672] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0093.673] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0093.673] Process32NextW (in: hSnapshot=0x2b4, lppe=0x295fd30 | out: lppe=0x295fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0093.674] CloseHandle (hObject=0x2b4) returned 1 [0093.674] Sleep (dwMilliseconds=0x1f4) Thread: id = 12 os_tid = 0xdf4 [0061.229] GetCurrentThreadId () returned 0xdf4 [0061.238] GetProcessHeap () returned 0x580000 [0061.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21a) returned 0x5ad710 [0061.242] GetProcessHeap () returned 0x580000 [0061.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x591480 [0061.247] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x284 [0061.247] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x288 [0061.247] GetComputerNameW (in: lpBuffer=0x5ad720, nSize=0x1ecdff78 | out: lpBuffer="NQDPDE", nSize=0x1ecdff78) returned 1 [0061.247] GetProcessHeap () returned 0x580000 [0061.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6d58 [0061.539] GetProcessHeap () returned 0x580000 [0061.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4000) returned 0x5aeaf8 [0061.544] GetProcessHeap () returned 0x580000 [0061.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5b2b00 [0061.549] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ecdff2c | out: lphEnum=0x1ecdff2c*=0x5a81a0) returned 0x0 [0064.278] WNetEnumResourceW (in: hEnum=0x5a81a0, lpcCount=0x1ecdff20, lpBuffer=0x5aeaf8, lpBufferSize=0x1ecdff34 | out: lpcCount=0x1ecdff20, lpBuffer=0x5aeaf8, lpBufferSize=0x1ecdff34) returned 0x103 [0064.278] WNetCloseEnum (hEnum=0x5a81a0) returned 0x0 [0064.278] GetProcessHeap () returned 0x580000 [0064.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0064.278] GetProcessHeap () returned 0x580000 [0064.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b2b00 | out: hHeap=0x580000) returned 1 [0064.279] GetProcessHeap () returned 0x580000 [0064.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4000) returned 0x64cbc8 [0064.284] GetProcessHeap () returned 0x580000 [0064.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0064.288] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ecdff14 | out: lphEnum=0x1ecdff14*=0x590d08) returned 0x0 [0064.290] WNetEnumResourceW (in: hEnum=0x590d08, lpcCount=0x1ecdff08, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff1c | out: lpcCount=0x1ecdff08, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff1c) returned 0x103 [0064.290] WNetCloseEnum (hEnum=0x590d08) returned 0x0 [0064.290] GetProcessHeap () returned 0x580000 [0064.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64cbc8 | out: hHeap=0x580000) returned 1 [0064.290] GetProcessHeap () returned 0x580000 [0064.291] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0064.291] GetProcessHeap () returned 0x580000 [0064.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4000) returned 0x64cbc8 [0064.296] GetProcessHeap () returned 0x580000 [0064.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0064.300] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ecdfefc | out: lphEnum=0x1ecdfefc*=0x5a8300) returned 0x0 [0078.163] WNetEnumResourceW (in: hEnum=0x5a8300, lpcCount=0x1ecdfef0, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff04 | out: lpcCount=0x1ecdfef0, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff04) returned 0x0 [0078.172] WNetCloseEnum (hEnum=0x5a8300) returned 0x0 [0078.172] GetProcessHeap () returned 0x580000 [0078.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64cbc8 | out: hHeap=0x580000) returned 1 [0078.172] GetProcessHeap () returned 0x580000 [0078.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0078.173] GetProcessHeap () returned 0x580000 [0078.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4000) returned 0x64cbc8 [0078.178] GetProcessHeap () returned 0x580000 [0078.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0078.183] WNetOpenEnumW (in: dwScope=0x3, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ecdff2c | out: lphEnum=0x1ecdff2c*=0x590d08) returned 0x0 [0078.184] WNetEnumResourceW (in: hEnum=0x590d08, lpcCount=0x1ecdff20, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff34 | out: lpcCount=0x1ecdff20, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff34) returned 0x103 [0078.185] WNetCloseEnum (hEnum=0x590d08) returned 0x0 [0078.185] GetProcessHeap () returned 0x580000 [0078.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64cbc8 | out: hHeap=0x580000) returned 1 [0078.185] GetProcessHeap () returned 0x580000 [0078.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0078.185] GetProcessHeap () returned 0x580000 [0078.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4000) returned 0x64cbc8 [0078.553] GetProcessHeap () returned 0x580000 [0078.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0078.557] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ecdff14 | out: lphEnum=0x1ecdff14*=0x64c5a8) returned 0x0 [0078.557] WNetEnumResourceW (in: hEnum=0x64c5a8, lpcCount=0x1ecdff08, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff1c | out: lpcCount=0x1ecdff08, lpBuffer=0x64cbc8, lpBufferSize=0x1ecdff1c) returned 0x0 [0078.566] WNetCloseEnum (hEnum=0x64c5a8) returned 0x0 [0078.566] GetProcessHeap () returned 0x580000 [0078.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64cbc8 | out: hHeap=0x580000) returned 1 [0078.566] GetProcessHeap () returned 0x580000 [0078.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0078.566] GetProcessHeap () returned 0x580000 [0078.570] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a98) returned 0x64cbc8 [0078.571] GetIpAddrTable (in: pIpAddrTable=0x64cbc8, pdwSize=0x1ecdff14, bOrder=0 | out: pIpAddrTable=0x64cbc8, pdwSize=0x1ecdff14) returned 0x0 [0079.639] htonl (hostlong=0x2c00a8c0) returned 0xc0a8002c [0079.639] htonl (hostlong=0x2c00a8c0) returned 0xc0a8002c [0079.639] htonl (hostlong=0xffffff) returned 0xffffff00 [0079.639] htons (hostshort=0x1bd) returned 0xbd01 [0079.639] GetProcessHeap () returned 0x580000 [0079.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x6752d0 [0079.639] GetProcessHeap () returned 0x580000 [0079.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x1ffb3098 [0079.639] htonl (hostlong=0xc0a80000) returned 0xa8c0 [0079.639] socket (af=2, type=1, protocol=6) returned 0x388 [0080.044] ioctlsocket (in: s=0x388, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.044] connect (s=0x388, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.0"), namelen=16) returned -1 [0080.050] WSAGetLastError () returned 10035 [0080.050] htonl (hostlong=0xc0a80001) returned 0x100a8c0 [0080.050] socket (af=2, type=1, protocol=6) returned 0x39c [0080.050] ioctlsocket (in: s=0x39c, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.050] connect (s=0x39c, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.1"), namelen=16) returned -1 [0080.051] WSAGetLastError () returned 10035 [0080.051] htonl (hostlong=0xc0a80002) returned 0x200a8c0 [0080.051] socket (af=2, type=1, protocol=6) returned 0x3a0 [0080.051] ioctlsocket (in: s=0x3a0, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.051] connect (s=0x3a0, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.2"), namelen=16) returned -1 [0080.052] WSAGetLastError () returned 10035 [0080.052] htonl (hostlong=0xc0a80003) returned 0x300a8c0 [0080.052] socket (af=2, type=1, protocol=6) returned 0x3a4 [0080.052] ioctlsocket (in: s=0x3a4, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.052] connect (s=0x3a4, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.3"), namelen=16) returned -1 [0080.053] WSAGetLastError () returned 10035 [0080.053] htonl (hostlong=0xc0a80004) returned 0x400a8c0 [0080.053] socket (af=2, type=1, protocol=6) returned 0x3a8 [0080.053] ioctlsocket (in: s=0x3a8, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.053] connect (s=0x3a8, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.4"), namelen=16) returned -1 [0080.054] WSAGetLastError () returned 10035 [0080.054] htonl (hostlong=0xc0a80005) returned 0x500a8c0 [0080.054] socket (af=2, type=1, protocol=6) returned 0x3ac [0080.054] ioctlsocket (in: s=0x3ac, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.054] connect (s=0x3ac, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.5"), namelen=16) returned -1 [0080.055] WSAGetLastError () returned 10035 [0080.055] htonl (hostlong=0xc0a80006) returned 0x600a8c0 [0080.055] socket (af=2, type=1, protocol=6) returned 0x3b0 [0080.055] ioctlsocket (in: s=0x3b0, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.055] connect (s=0x3b0, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.6"), namelen=16) returned -1 [0080.056] WSAGetLastError () returned 10035 [0080.056] htonl (hostlong=0xc0a80007) returned 0x700a8c0 [0080.056] socket (af=2, type=1, protocol=6) returned 0x3b4 [0080.056] ioctlsocket (in: s=0x3b4, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.057] connect (s=0x3b4, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.7"), namelen=16) returned -1 [0080.058] WSAGetLastError () returned 10035 [0080.058] htonl (hostlong=0xc0a80008) returned 0x800a8c0 [0080.058] socket (af=2, type=1, protocol=6) returned 0x3b8 [0080.058] ioctlsocket (in: s=0x3b8, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.058] connect (s=0x3b8, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.8"), namelen=16) returned -1 [0080.059] WSAGetLastError () returned 10035 [0080.059] htonl (hostlong=0xc0a80009) returned 0x900a8c0 [0080.059] socket (af=2, type=1, protocol=6) returned 0x3bc [0080.059] ioctlsocket (in: s=0x3bc, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.060] connect (s=0x3bc, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.9"), namelen=16) returned -1 [0080.060] WSAGetLastError () returned 10035 [0080.060] htonl (hostlong=0xc0a8000a) returned 0xa00a8c0 [0080.060] socket (af=2, type=1, protocol=6) returned 0x3c0 [0080.061] ioctlsocket (in: s=0x3c0, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.061] connect (s=0x3c0, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.10"), namelen=16) returned -1 [0080.062] WSAGetLastError () returned 10035 [0080.062] htonl (hostlong=0xc0a8000b) returned 0xb00a8c0 [0080.062] socket (af=2, type=1, protocol=6) returned 0x3c4 [0080.062] ioctlsocket (in: s=0x3c4, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.062] connect (s=0x3c4, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.11"), namelen=16) returned -1 [0080.063] WSAGetLastError () returned 10035 [0080.063] htonl (hostlong=0xc0a8000c) returned 0xc00a8c0 [0080.063] socket (af=2, type=1, protocol=6) returned 0x3c8 [0080.063] ioctlsocket (in: s=0x3c8, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.063] connect (s=0x3c8, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.12"), namelen=16) returned -1 [0080.064] WSAGetLastError () returned 10035 [0080.064] htonl (hostlong=0xc0a8000d) returned 0xd00a8c0 [0080.064] socket (af=2, type=1, protocol=6) returned 0x3cc [0080.064] ioctlsocket (in: s=0x3cc, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.064] connect (s=0x3cc, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.13"), namelen=16) returned -1 [0080.065] WSAGetLastError () returned 10035 [0080.065] htonl (hostlong=0xc0a8000e) returned 0xe00a8c0 [0080.065] socket (af=2, type=1, protocol=6) returned 0x3d0 [0080.065] ioctlsocket (in: s=0x3d0, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.065] connect (s=0x3d0, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.14"), namelen=16) returned -1 [0080.067] WSAGetLastError () returned 10035 [0080.067] htonl (hostlong=0xc0a8000f) returned 0xf00a8c0 [0080.067] socket (af=2, type=1, protocol=6) returned 0x3d4 [0080.067] ioctlsocket (in: s=0x3d4, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.067] connect (s=0x3d4, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.15"), namelen=16) returned -1 [0080.068] WSAGetLastError () returned 10035 [0080.068] htonl (hostlong=0xc0a80010) returned 0x1000a8c0 [0080.068] socket (af=2, type=1, protocol=6) returned 0x3d8 [0080.068] ioctlsocket (in: s=0x3d8, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.068] connect (s=0x3d8, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.16"), namelen=16) returned -1 [0080.070] WSAGetLastError () returned 10035 [0080.070] htonl (hostlong=0xc0a80011) returned 0x1100a8c0 [0080.070] socket (af=2, type=1, protocol=6) returned 0x3dc [0080.070] ioctlsocket (in: s=0x3dc, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.070] connect (s=0x3dc, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.17"), namelen=16) returned -1 [0080.071] WSAGetLastError () returned 10035 [0080.071] htonl (hostlong=0xc0a80012) returned 0x1200a8c0 [0080.071] socket (af=2, type=1, protocol=6) returned 0x3e0 [0080.072] ioctlsocket (in: s=0x3e0, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.072] connect (s=0x3e0, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.18"), namelen=16) returned -1 [0080.072] WSAGetLastError () returned 10035 [0080.072] htonl (hostlong=0xc0a80013) returned 0x1300a8c0 [0080.072] socket (af=2, type=1, protocol=6) returned 0x3e4 [0080.073] ioctlsocket (in: s=0x3e4, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.073] connect (s=0x3e4, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.19"), namelen=16) returned -1 [0080.074] WSAGetLastError () returned 10035 [0080.074] htonl (hostlong=0xc0a80014) returned 0x1400a8c0 [0080.074] socket (af=2, type=1, protocol=6) returned 0x3e8 [0080.074] ioctlsocket (in: s=0x3e8, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.074] connect (s=0x3e8, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.20"), namelen=16) returned -1 [0080.075] WSAGetLastError () returned 10035 [0080.075] htonl (hostlong=0xc0a80015) returned 0x1500a8c0 [0080.075] socket (af=2, type=1, protocol=6) returned 0x3ec [0080.075] ioctlsocket (in: s=0x3ec, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.075] connect (s=0x3ec, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.21"), namelen=16) returned -1 [0080.076] WSAGetLastError () returned 10035 [0080.076] htonl (hostlong=0xc0a80016) returned 0x1600a8c0 [0080.076] socket (af=2, type=1, protocol=6) returned 0x3f0 [0080.076] ioctlsocket (in: s=0x3f0, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.076] connect (s=0x3f0, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.22"), namelen=16) returned -1 [0080.077] WSAGetLastError () returned 10035 [0080.077] htonl (hostlong=0xc0a80017) returned 0x1700a8c0 [0080.077] socket (af=2, type=1, protocol=6) returned 0x3f4 [0080.077] ioctlsocket (in: s=0x3f4, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.077] connect (s=0x3f4, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.23"), namelen=16) returned -1 [0080.078] WSAGetLastError () returned 10035 [0080.078] htonl (hostlong=0xc0a80018) returned 0x1800a8c0 [0080.078] socket (af=2, type=1, protocol=6) returned 0x3f8 [0080.078] ioctlsocket (in: s=0x3f8, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.078] connect (s=0x3f8, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.24"), namelen=16) returned -1 [0080.079] WSAGetLastError () returned 10035 [0080.079] htonl (hostlong=0xc0a80019) returned 0x1900a8c0 [0080.079] socket (af=2, type=1, protocol=6) returned 0x3fc [0080.080] ioctlsocket (in: s=0x3fc, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.080] connect (s=0x3fc, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.25"), namelen=16) returned -1 [0080.080] WSAGetLastError () returned 10035 [0080.081] htonl (hostlong=0xc0a8001a) returned 0x1a00a8c0 [0080.081] socket (af=2, type=1, protocol=6) returned 0x404 [0080.081] ioctlsocket (in: s=0x404, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.081] connect (s=0x404, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.26"), namelen=16) returned -1 [0080.082] WSAGetLastError () returned 10035 [0080.082] htonl (hostlong=0xc0a8001b) returned 0x1b00a8c0 [0080.082] socket (af=2, type=1, protocol=6) returned 0x408 [0080.082] ioctlsocket (in: s=0x408, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.082] connect (s=0x408, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.27"), namelen=16) returned -1 [0080.083] WSAGetLastError () returned 10035 [0080.083] htonl (hostlong=0xc0a8001c) returned 0x1c00a8c0 [0080.083] socket (af=2, type=1, protocol=6) returned 0x40c [0080.083] ioctlsocket (in: s=0x40c, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.083] connect (s=0x40c, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.28"), namelen=16) returned -1 [0080.084] WSAGetLastError () returned 10035 [0080.084] htonl (hostlong=0xc0a8001d) returned 0x1d00a8c0 [0080.084] socket (af=2, type=1, protocol=6) returned 0x410 [0080.084] ioctlsocket (in: s=0x410, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.084] connect (s=0x410, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.29"), namelen=16) returned -1 [0080.291] WSAGetLastError () returned 10035 [0080.291] htonl (hostlong=0xc0a8001e) returned 0x1e00a8c0 [0080.291] socket (af=2, type=1, protocol=6) returned 0x390 [0080.291] ioctlsocket (in: s=0x390, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.291] connect (s=0x390, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.30"), namelen=16) returned -1 [0080.292] WSAGetLastError () returned 10035 [0080.292] htonl (hostlong=0xc0a8001f) returned 0x1f00a8c0 [0080.292] socket (af=2, type=1, protocol=6) returned 0x418 [0080.292] ioctlsocket (in: s=0x418, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.292] connect (s=0x418, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.31"), namelen=16) returned -1 [0080.293] WSAGetLastError () returned 10035 [0080.293] htonl (hostlong=0xc0a80020) returned 0x2000a8c0 [0080.293] socket (af=2, type=1, protocol=6) returned 0x38c [0080.293] ioctlsocket (in: s=0x38c, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.293] connect (s=0x38c, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.32"), namelen=16) returned -1 [0080.296] WSAGetLastError () returned 10035 [0080.296] htonl (hostlong=0xc0a80021) returned 0x2100a8c0 [0080.296] socket (af=2, type=1, protocol=6) returned 0x414 [0080.296] ioctlsocket (in: s=0x414, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.296] connect (s=0x414, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.33"), namelen=16) returned -1 [0080.297] WSAGetLastError () returned 10035 [0080.297] htonl (hostlong=0xc0a80022) returned 0x2200a8c0 [0080.297] socket (af=2, type=1, protocol=6) returned 0x41c [0080.297] ioctlsocket (in: s=0x41c, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.297] connect (s=0x41c, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.34"), namelen=16) returned -1 [0080.298] WSAGetLastError () returned 10035 [0080.298] htonl (hostlong=0xc0a80023) returned 0x2300a8c0 [0080.298] socket (af=2, type=1, protocol=6) returned 0x420 [0080.298] ioctlsocket (in: s=0x420, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.298] connect (s=0x420, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.35"), namelen=16) returned -1 [0080.299] WSAGetLastError () returned 10035 [0080.299] htonl (hostlong=0xc0a80024) returned 0x2400a8c0 [0080.299] socket (af=2, type=1, protocol=6) returned 0x424 [0080.299] ioctlsocket (in: s=0x424, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.299] connect (s=0x424, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.36"), namelen=16) returned -1 [0080.300] WSAGetLastError () returned 10035 [0080.300] htonl (hostlong=0xc0a80025) returned 0x2500a8c0 [0080.300] socket (af=2, type=1, protocol=6) returned 0x428 [0080.301] ioctlsocket (in: s=0x428, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.301] connect (s=0x428, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.37"), namelen=16) returned -1 [0080.302] WSAGetLastError () returned 10035 [0080.302] htonl (hostlong=0xc0a80026) returned 0x2600a8c0 [0080.302] socket (af=2, type=1, protocol=6) returned 0x42c [0080.302] ioctlsocket (in: s=0x42c, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.302] connect (s=0x42c, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.38"), namelen=16) returned -1 [0080.303] WSAGetLastError () returned 10035 [0080.303] htonl (hostlong=0xc0a80027) returned 0x2700a8c0 [0080.303] socket (af=2, type=1, protocol=6) returned 0x430 [0080.303] ioctlsocket (in: s=0x430, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.303] connect (s=0x430, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.39"), namelen=16) returned -1 [0080.304] WSAGetLastError () returned 10035 [0080.304] htonl (hostlong=0xc0a80028) returned 0x2800a8c0 [0080.304] socket (af=2, type=1, protocol=6) returned 0x434 [0080.304] ioctlsocket (in: s=0x434, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.304] connect (s=0x434, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.40"), namelen=16) returned -1 [0080.305] WSAGetLastError () returned 10035 [0080.305] htonl (hostlong=0xc0a80029) returned 0x2900a8c0 [0080.305] socket (af=2, type=1, protocol=6) returned 0x438 [0080.305] ioctlsocket (in: s=0x438, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.305] connect (s=0x438, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.41"), namelen=16) returned -1 [0080.306] WSAGetLastError () returned 10035 [0080.306] htonl (hostlong=0xc0a8002a) returned 0x2a00a8c0 [0080.306] socket (af=2, type=1, protocol=6) returned 0x43c [0080.306] ioctlsocket (in: s=0x43c, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.306] connect (s=0x43c, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.42"), namelen=16) returned -1 [0080.307] WSAGetLastError () returned 10035 [0080.307] htonl (hostlong=0xc0a8002b) returned 0x2b00a8c0 [0080.307] socket (af=2, type=1, protocol=6) returned 0x440 [0080.308] ioctlsocket (in: s=0x440, cmd=-2147195266, argp=0x1ecdfed0 | out: argp=0x1ecdfed0) returned 0 [0080.308] connect (s=0x440, name=0x1ecdfeb8*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.43"), namelen=16) returned -1 [0080.308] WSAGetLastError () returned 10035 [0080.308] GetTickCount () returned 0x115468b [0080.308] GetTickCount () returned 0x115468b [0080.308] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.309] GetTickCount () returned 0x115468b [0080.309] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.310] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.310] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.311] GetTickCount () returned 0x115468b [0080.311] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.312] GetTickCount () returned 0x115468b [0080.312] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.313] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.313] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.314] GetTickCount () returned 0x115468b [0080.314] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.315] GetTickCount () returned 0x115468b [0080.315] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115468b [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115468b [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115468b [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115468b [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115468b [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115468b [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115468b [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115469a [0080.316] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.316] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.317] GetTickCount () returned 0x115469a [0080.317] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.318] GetTickCount () returned 0x115469a [0080.318] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.319] GetTickCount () returned 0x115469a [0080.319] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.320] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.320] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.321] GetTickCount () returned 0x115469a [0080.321] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.322] GetTickCount () returned 0x115469a [0080.322] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.322] GetTickCount () returned 0x115469a [0080.322] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.322] GetTickCount () returned 0x115469a [0080.322] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.322] GetTickCount () returned 0x115469a [0080.322] select (in: nfds=0, readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68, timeout=0x1ecdfe78 | out: readfds=0x1ecdfd70, writefds=0x0, exceptfds=0x1ecdfc68) returned -1 [0080.322] GetTickCount () returned 0x115469a [0080.322] getsockopt (in: s=0x440, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.323] recv (in: s=0x440, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.323] WSAGetLastError () returned 10057 [0080.323] closesocket (s=0x440) returned 0 [0080.323] getsockopt (in: s=0x43c, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.323] recv (in: s=0x43c, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.323] WSAGetLastError () returned 10057 [0080.323] closesocket (s=0x43c) returned 0 [0080.324] getsockopt (in: s=0x438, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.324] recv (in: s=0x438, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.324] WSAGetLastError () returned 10057 [0080.324] closesocket (s=0x438) returned 0 [0080.324] getsockopt (in: s=0x434, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.324] recv (in: s=0x434, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.324] WSAGetLastError () returned 10057 [0080.324] closesocket (s=0x434) returned 0 [0080.324] getsockopt (in: s=0x430, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.324] recv (in: s=0x430, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.324] WSAGetLastError () returned 10057 [0080.324] closesocket (s=0x430) returned 0 [0080.325] getsockopt (in: s=0x42c, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.325] recv (in: s=0x42c, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.325] WSAGetLastError () returned 10057 [0080.325] closesocket (s=0x42c) returned 0 [0080.325] getsockopt (in: s=0x428, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.325] recv (in: s=0x428, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.325] WSAGetLastError () returned 10057 [0080.325] closesocket (s=0x428) returned 0 [0080.325] getsockopt (in: s=0x424, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.325] recv (in: s=0x424, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.325] WSAGetLastError () returned 10057 [0080.325] closesocket (s=0x424) returned 0 [0080.326] getsockopt (in: s=0x420, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.326] recv (in: s=0x420, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.326] WSAGetLastError () returned 10057 [0080.326] closesocket (s=0x420) returned 0 [0080.326] getsockopt (in: s=0x41c, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.326] recv (in: s=0x41c, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.326] WSAGetLastError () returned 10057 [0080.326] closesocket (s=0x41c) returned 0 [0080.326] getsockopt (in: s=0x414, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.326] recv (in: s=0x414, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.326] WSAGetLastError () returned 10057 [0080.326] closesocket (s=0x414) returned 0 [0080.327] getsockopt (in: s=0x38c, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.327] recv (in: s=0x38c, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.327] WSAGetLastError () returned 10057 [0080.327] closesocket (s=0x38c) returned 0 [0080.327] getsockopt (in: s=0x418, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.327] recv (in: s=0x418, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.327] WSAGetLastError () returned 10057 [0080.327] closesocket (s=0x418) returned 0 [0080.327] getsockopt (in: s=0x390, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.327] recv (in: s=0x390, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.327] WSAGetLastError () returned 10057 [0080.327] closesocket (s=0x390) returned 0 [0080.328] getsockopt (in: s=0x410, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.328] recv (in: s=0x410, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.328] WSAGetLastError () returned 10057 [0080.328] closesocket (s=0x410) returned 0 [0080.328] getsockopt (in: s=0x40c, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.328] recv (in: s=0x40c, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.328] WSAGetLastError () returned 10057 [0080.328] closesocket (s=0x40c) returned 0 [0080.328] getsockopt (in: s=0x408, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.328] recv (in: s=0x408, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.329] WSAGetLastError () returned 10057 [0080.329] closesocket (s=0x408) returned 0 [0080.329] getsockopt (in: s=0x404, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.329] recv (in: s=0x404, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.329] WSAGetLastError () returned 10057 [0080.329] closesocket (s=0x404) returned 0 [0080.329] getsockopt (in: s=0x3fc, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.329] recv (in: s=0x3fc, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.329] WSAGetLastError () returned 10057 [0080.329] closesocket (s=0x3fc) returned 0 [0080.329] getsockopt (in: s=0x3f8, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.330] recv (in: s=0x3f8, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.330] WSAGetLastError () returned 10057 [0080.330] closesocket (s=0x3f8) returned 0 [0080.330] getsockopt (in: s=0x3f4, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.330] recv (in: s=0x3f4, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.330] WSAGetLastError () returned 10057 [0080.330] closesocket (s=0x3f4) returned 0 [0080.330] getsockopt (in: s=0x3f0, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.330] recv (in: s=0x3f0, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.330] WSAGetLastError () returned 10057 [0080.330] closesocket (s=0x3f0) returned 0 [0080.331] getsockopt (in: s=0x3ec, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.331] recv (in: s=0x3ec, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.331] WSAGetLastError () returned 10057 [0080.331] closesocket (s=0x3ec) returned 0 [0080.331] getsockopt (in: s=0x3e8, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.331] recv (in: s=0x3e8, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.331] WSAGetLastError () returned 10057 [0080.331] closesocket (s=0x3e8) returned 0 [0080.331] getsockopt (in: s=0x3e4, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.331] recv (in: s=0x3e4, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.331] WSAGetLastError () returned 10057 [0080.331] closesocket (s=0x3e4) returned 0 [0080.332] getsockopt (in: s=0x3e0, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.332] recv (in: s=0x3e0, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.332] WSAGetLastError () returned 10057 [0080.332] closesocket (s=0x3e0) returned 0 [0080.332] getsockopt (in: s=0x3dc, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.332] recv (in: s=0x3dc, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.332] WSAGetLastError () returned 10057 [0080.332] closesocket (s=0x3dc) returned 0 [0080.332] getsockopt (in: s=0x3d8, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.333] recv (in: s=0x3d8, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.333] WSAGetLastError () returned 10057 [0080.333] closesocket (s=0x3d8) returned 0 [0080.333] getsockopt (in: s=0x3d4, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.333] recv (in: s=0x3d4, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.333] WSAGetLastError () returned 10057 [0080.333] closesocket (s=0x3d4) returned 0 [0080.333] getsockopt (in: s=0x3d0, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.333] recv (in: s=0x3d0, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.333] WSAGetLastError () returned 10057 [0080.333] closesocket (s=0x3d0) returned 0 [0080.499] getsockopt (in: s=0x3cc, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.499] recv (in: s=0x3cc, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.499] WSAGetLastError () returned 10057 [0080.499] closesocket (s=0x3cc) returned 0 [0080.500] getsockopt (in: s=0x3c8, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.500] recv (in: s=0x3c8, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.500] WSAGetLastError () returned 10057 [0080.500] closesocket (s=0x3c8) returned 0 [0080.500] getsockopt (in: s=0x3c4, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.500] recv (in: s=0x3c4, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.500] WSAGetLastError () returned 10057 [0080.500] closesocket (s=0x3c4) returned 0 [0080.500] getsockopt (in: s=0x3c0, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.500] recv (in: s=0x3c0, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.500] WSAGetLastError () returned 10057 [0080.501] closesocket (s=0x3c0) returned 0 [0080.501] getsockopt (in: s=0x3bc, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.501] recv (in: s=0x3bc, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.501] WSAGetLastError () returned 10057 [0080.501] closesocket (s=0x3bc) returned 0 [0080.501] getsockopt (in: s=0x3b8, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.501] recv (in: s=0x3b8, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.501] WSAGetLastError () returned 10057 [0080.501] closesocket (s=0x3b8) returned 0 [0080.501] getsockopt (in: s=0x3b4, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.501] recv (in: s=0x3b4, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.502] WSAGetLastError () returned 10057 [0080.502] closesocket (s=0x3b4) returned 0 [0080.502] getsockopt (in: s=0x3b0, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.502] recv (in: s=0x3b0, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.502] WSAGetLastError () returned 10057 [0080.502] closesocket (s=0x3b0) returned 0 [0080.502] getsockopt (in: s=0x3ac, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.502] recv (in: s=0x3ac, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.502] WSAGetLastError () returned 10057 [0080.502] closesocket (s=0x3ac) returned 0 [0080.503] getsockopt (in: s=0x3a8, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.503] recv (in: s=0x3a8, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.503] WSAGetLastError () returned 10057 [0080.503] closesocket (s=0x3a8) returned 0 [0080.503] getsockopt (in: s=0x3a4, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.503] recv (in: s=0x3a4, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.503] WSAGetLastError () returned 10057 [0080.503] closesocket (s=0x3a4) returned 0 [0080.503] getsockopt (in: s=0x3a0, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.503] recv (in: s=0x3a0, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.503] WSAGetLastError () returned 10057 [0080.503] closesocket (s=0x3a0) returned 0 [0080.504] getsockopt (in: s=0x39c, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.504] recv (in: s=0x39c, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.504] WSAGetLastError () returned 10057 [0080.504] closesocket (s=0x39c) returned 0 [0080.504] getsockopt (in: s=0x388, level=65535, optname=4103, optval=0x1ecdfee0, optlen=0x1ecdfecc | out: optval="", optlen=0x1ecdfecc) returned 0 [0080.504] recv (in: s=0x388, buf=0x1ecdfeef, len=1, flags=2 | out: buf=0x1ecdfeef) returned -1 [0080.505] WSAGetLastError () returned 10057 [0080.505] closesocket (s=0x388) returned 0 [0080.505] GetProcessHeap () returned 0x580000 [0080.505] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6752d0 | out: hHeap=0x580000) returned 1 [0080.505] GetProcessHeap () returned 0x580000 [0080.505] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb3098 | out: hHeap=0x580000) returned 1 [0080.505] htons (hostshort=0x1bd) returned 0xbd01 [0080.505] GetProcessHeap () returned 0x580000 [0080.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x1ffb3098 [0080.505] GetProcessHeap () returned 0x580000 [0080.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x800) returned 0x6752d0 [0080.505] htonl (hostlong=0xc0a8002d) returned 0x2d00a8c0 [0080.505] socket (af=2, type=1, protocol=6) returned 0x388 [0080.505] ioctlsocket (in: s=0x388, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.505] connect (s=0x388, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.45"), namelen=16) returned -1 [0080.506] WSAGetLastError () returned 10035 [0080.506] htonl (hostlong=0xc0a8002e) returned 0x2e00a8c0 [0080.506] socket (af=2, type=1, protocol=6) returned 0x39c [0080.506] ioctlsocket (in: s=0x39c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.506] connect (s=0x39c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.46"), namelen=16) returned -1 [0080.507] WSAGetLastError () returned 10035 [0080.507] htonl (hostlong=0xc0a8002f) returned 0x2f00a8c0 [0080.507] socket (af=2, type=1, protocol=6) returned 0x3a0 [0080.507] ioctlsocket (in: s=0x3a0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.507] connect (s=0x3a0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.47"), namelen=16) returned -1 [0080.508] WSAGetLastError () returned 10035 [0080.508] htonl (hostlong=0xc0a80030) returned 0x3000a8c0 [0080.508] socket (af=2, type=1, protocol=6) returned 0x3a4 [0080.508] ioctlsocket (in: s=0x3a4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.508] connect (s=0x3a4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.48"), namelen=16) returned -1 [0080.508] WSAGetLastError () returned 10035 [0080.509] htonl (hostlong=0xc0a80031) returned 0x3100a8c0 [0080.509] socket (af=2, type=1, protocol=6) returned 0x3a8 [0080.509] ioctlsocket (in: s=0x3a8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.509] connect (s=0x3a8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.49"), namelen=16) returned -1 [0080.509] WSAGetLastError () returned 10035 [0080.509] htonl (hostlong=0xc0a80032) returned 0x3200a8c0 [0080.509] socket (af=2, type=1, protocol=6) returned 0x3ac [0080.509] ioctlsocket (in: s=0x3ac, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.510] connect (s=0x3ac, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.50"), namelen=16) returned -1 [0080.510] WSAGetLastError () returned 10035 [0080.510] htonl (hostlong=0xc0a80033) returned 0x3300a8c0 [0080.510] socket (af=2, type=1, protocol=6) returned 0x3b0 [0080.510] ioctlsocket (in: s=0x3b0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.510] connect (s=0x3b0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.51"), namelen=16) returned -1 [0080.511] WSAGetLastError () returned 10035 [0080.511] htonl (hostlong=0xc0a80034) returned 0x3400a8c0 [0080.511] socket (af=2, type=1, protocol=6) returned 0x3b4 [0080.511] ioctlsocket (in: s=0x3b4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.511] connect (s=0x3b4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.52"), namelen=16) returned -1 [0080.512] WSAGetLastError () returned 10035 [0080.512] htonl (hostlong=0xc0a80035) returned 0x3500a8c0 [0080.512] socket (af=2, type=1, protocol=6) returned 0x3b8 [0080.512] ioctlsocket (in: s=0x3b8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.512] connect (s=0x3b8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.53"), namelen=16) returned -1 [0080.512] WSAGetLastError () returned 10035 [0080.512] htonl (hostlong=0xc0a80036) returned 0x3600a8c0 [0080.512] socket (af=2, type=1, protocol=6) returned 0x3bc [0080.513] ioctlsocket (in: s=0x3bc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.513] connect (s=0x3bc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.54"), namelen=16) returned -1 [0080.513] WSAGetLastError () returned 10035 [0080.513] htonl (hostlong=0xc0a80037) returned 0x3700a8c0 [0080.513] socket (af=2, type=1, protocol=6) returned 0x3c0 [0080.513] ioctlsocket (in: s=0x3c0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.513] connect (s=0x3c0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.55"), namelen=16) returned -1 [0080.514] WSAGetLastError () returned 10035 [0080.514] htonl (hostlong=0xc0a80038) returned 0x3800a8c0 [0080.514] socket (af=2, type=1, protocol=6) returned 0x3c4 [0080.514] ioctlsocket (in: s=0x3c4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.514] connect (s=0x3c4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.56"), namelen=16) returned -1 [0080.515] WSAGetLastError () returned 10035 [0080.515] htonl (hostlong=0xc0a80039) returned 0x3900a8c0 [0080.515] socket (af=2, type=1, protocol=6) returned 0x3c8 [0080.515] ioctlsocket (in: s=0x3c8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.515] connect (s=0x3c8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.57"), namelen=16) returned -1 [0080.516] WSAGetLastError () returned 10035 [0080.516] htonl (hostlong=0xc0a8003a) returned 0x3a00a8c0 [0080.516] socket (af=2, type=1, protocol=6) returned 0x3cc [0080.516] ioctlsocket (in: s=0x3cc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.516] connect (s=0x3cc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.58"), namelen=16) returned -1 [0080.516] WSAGetLastError () returned 10035 [0080.516] htonl (hostlong=0xc0a8003b) returned 0x3b00a8c0 [0080.516] socket (af=2, type=1, protocol=6) returned 0x3e0 [0080.517] ioctlsocket (in: s=0x3e0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.517] connect (s=0x3e0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.59"), namelen=16) returned -1 [0080.517] WSAGetLastError () returned 10035 [0080.517] htonl (hostlong=0xc0a8003c) returned 0x3c00a8c0 [0080.517] socket (af=2, type=1, protocol=6) returned 0x3e4 [0080.517] ioctlsocket (in: s=0x3e4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.517] connect (s=0x3e4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.60"), namelen=16) returned -1 [0080.518] WSAGetLastError () returned 10035 [0080.518] htonl (hostlong=0xc0a8003d) returned 0x3d00a8c0 [0080.518] socket (af=2, type=1, protocol=6) returned 0x3e8 [0080.518] ioctlsocket (in: s=0x3e8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.518] connect (s=0x3e8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.61"), namelen=16) returned -1 [0080.519] WSAGetLastError () returned 10035 [0080.519] htonl (hostlong=0xc0a8003e) returned 0x3e00a8c0 [0080.519] socket (af=2, type=1, protocol=6) returned 0x3ec [0080.519] ioctlsocket (in: s=0x3ec, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.519] connect (s=0x3ec, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.62"), namelen=16) returned -1 [0080.520] WSAGetLastError () returned 10035 [0080.520] htonl (hostlong=0xc0a8003f) returned 0x3f00a8c0 [0080.520] socket (af=2, type=1, protocol=6) returned 0x3f0 [0080.520] ioctlsocket (in: s=0x3f0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.520] connect (s=0x3f0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.63"), namelen=16) returned -1 [0080.521] WSAGetLastError () returned 10035 [0080.521] htonl (hostlong=0xc0a80040) returned 0x4000a8c0 [0080.521] socket (af=2, type=1, protocol=6) returned 0x3f4 [0080.521] ioctlsocket (in: s=0x3f4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.521] connect (s=0x3f4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.64"), namelen=16) returned -1 [0080.521] WSAGetLastError () returned 10035 [0080.521] htonl (hostlong=0xc0a80041) returned 0x4100a8c0 [0080.521] socket (af=2, type=1, protocol=6) returned 0x3f8 [0080.522] ioctlsocket (in: s=0x3f8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.522] connect (s=0x3f8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.65"), namelen=16) returned -1 [0080.522] WSAGetLastError () returned 10035 [0080.522] htonl (hostlong=0xc0a80042) returned 0x4200a8c0 [0080.522] socket (af=2, type=1, protocol=6) returned 0x3fc [0080.522] ioctlsocket (in: s=0x3fc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.522] connect (s=0x3fc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.66"), namelen=16) returned -1 [0080.523] WSAGetLastError () returned 10035 [0080.523] htonl (hostlong=0xc0a80043) returned 0x4300a8c0 [0080.523] socket (af=2, type=1, protocol=6) returned 0x404 [0080.523] ioctlsocket (in: s=0x404, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.523] connect (s=0x404, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.67"), namelen=16) returned -1 [0080.524] WSAGetLastError () returned 10035 [0080.524] htonl (hostlong=0xc0a80044) returned 0x4400a8c0 [0080.524] socket (af=2, type=1, protocol=6) returned 0x408 [0080.524] ioctlsocket (in: s=0x408, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.524] connect (s=0x408, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.68"), namelen=16) returned -1 [0080.524] WSAGetLastError () returned 10035 [0080.525] htonl (hostlong=0xc0a80045) returned 0x4500a8c0 [0080.525] socket (af=2, type=1, protocol=6) returned 0x40c [0080.525] ioctlsocket (in: s=0x40c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.525] connect (s=0x40c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.69"), namelen=16) returned -1 [0080.525] WSAGetLastError () returned 10035 [0080.525] htonl (hostlong=0xc0a80046) returned 0x4600a8c0 [0080.525] socket (af=2, type=1, protocol=6) returned 0x410 [0080.526] ioctlsocket (in: s=0x410, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.526] connect (s=0x410, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.70"), namelen=16) returned -1 [0080.526] WSAGetLastError () returned 10035 [0080.526] htonl (hostlong=0xc0a80047) returned 0x4700a8c0 [0080.526] socket (af=2, type=1, protocol=6) returned 0x390 [0080.526] ioctlsocket (in: s=0x390, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.526] connect (s=0x390, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.71"), namelen=16) returned -1 [0080.527] WSAGetLastError () returned 10035 [0080.527] htonl (hostlong=0xc0a80048) returned 0x4800a8c0 [0080.527] socket (af=2, type=1, protocol=6) returned 0x418 [0080.527] ioctlsocket (in: s=0x418, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.527] connect (s=0x418, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.72"), namelen=16) returned -1 [0080.528] WSAGetLastError () returned 10035 [0080.528] htonl (hostlong=0xc0a80049) returned 0x4900a8c0 [0080.528] socket (af=2, type=1, protocol=6) returned 0x38c [0080.528] ioctlsocket (in: s=0x38c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.528] connect (s=0x38c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.73"), namelen=16) returned -1 [0080.529] WSAGetLastError () returned 10035 [0080.529] htonl (hostlong=0xc0a8004a) returned 0x4a00a8c0 [0080.529] socket (af=2, type=1, protocol=6) returned 0x414 [0080.529] ioctlsocket (in: s=0x414, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.529] connect (s=0x414, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.74"), namelen=16) returned -1 [0080.529] WSAGetLastError () returned 10035 [0080.529] htonl (hostlong=0xc0a8004b) returned 0x4b00a8c0 [0080.529] socket (af=2, type=1, protocol=6) returned 0x41c [0080.530] ioctlsocket (in: s=0x41c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.530] connect (s=0x41c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.75"), namelen=16) returned -1 [0080.530] WSAGetLastError () returned 10035 [0080.530] htonl (hostlong=0xc0a8004c) returned 0x4c00a8c0 [0080.530] socket (af=2, type=1, protocol=6) returned 0x420 [0080.531] ioctlsocket (in: s=0x420, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.531] connect (s=0x420, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.76"), namelen=16) returned -1 [0080.531] WSAGetLastError () returned 10035 [0080.531] htonl (hostlong=0xc0a8004d) returned 0x4d00a8c0 [0080.531] socket (af=2, type=1, protocol=6) returned 0x424 [0080.531] ioctlsocket (in: s=0x424, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.532] connect (s=0x424, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.77"), namelen=16) returned -1 [0080.532] WSAGetLastError () returned 10035 [0080.532] htonl (hostlong=0xc0a8004e) returned 0x4e00a8c0 [0080.532] socket (af=2, type=1, protocol=6) returned 0x428 [0080.532] ioctlsocket (in: s=0x428, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.532] connect (s=0x428, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.78"), namelen=16) returned -1 [0080.533] WSAGetLastError () returned 10035 [0080.533] htonl (hostlong=0xc0a8004f) returned 0x4f00a8c0 [0080.533] socket (af=2, type=1, protocol=6) returned 0x42c [0080.533] ioctlsocket (in: s=0x42c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.533] connect (s=0x42c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.79"), namelen=16) returned -1 [0080.534] WSAGetLastError () returned 10035 [0080.534] htonl (hostlong=0xc0a80050) returned 0x5000a8c0 [0080.534] socket (af=2, type=1, protocol=6) returned 0x430 [0080.534] ioctlsocket (in: s=0x430, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.534] connect (s=0x430, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.80"), namelen=16) returned -1 [0080.535] WSAGetLastError () returned 10035 [0080.535] htonl (hostlong=0xc0a80051) returned 0x5100a8c0 [0080.535] socket (af=2, type=1, protocol=6) returned 0x434 [0080.535] ioctlsocket (in: s=0x434, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.535] connect (s=0x434, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.81"), namelen=16) returned -1 [0080.536] WSAGetLastError () returned 10035 [0080.536] htonl (hostlong=0xc0a80052) returned 0x5200a8c0 [0080.536] socket (af=2, type=1, protocol=6) returned 0x438 [0080.536] ioctlsocket (in: s=0x438, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.536] connect (s=0x438, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.82"), namelen=16) returned -1 [0080.537] WSAGetLastError () returned 10035 [0080.537] htonl (hostlong=0xc0a80053) returned 0x5300a8c0 [0080.537] socket (af=2, type=1, protocol=6) returned 0x43c [0080.537] ioctlsocket (in: s=0x43c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.537] connect (s=0x43c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.83"), namelen=16) returned -1 [0080.537] WSAGetLastError () returned 10035 [0080.537] htonl (hostlong=0xc0a80054) returned 0x5400a8c0 [0080.537] socket (af=2, type=1, protocol=6) returned 0x440 [0080.538] ioctlsocket (in: s=0x440, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.538] connect (s=0x440, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.84"), namelen=16) returned -1 [0080.538] WSAGetLastError () returned 10035 [0080.538] htonl (hostlong=0xc0a80055) returned 0x5500a8c0 [0080.538] socket (af=2, type=1, protocol=6) returned 0x444 [0080.539] ioctlsocket (in: s=0x444, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.539] connect (s=0x444, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.85"), namelen=16) returned -1 [0080.539] WSAGetLastError () returned 10035 [0080.539] htonl (hostlong=0xc0a80056) returned 0x5600a8c0 [0080.539] socket (af=2, type=1, protocol=6) returned 0x448 [0080.539] ioctlsocket (in: s=0x448, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.539] connect (s=0x448, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.86"), namelen=16) returned -1 [0080.540] WSAGetLastError () returned 10035 [0080.540] htonl (hostlong=0xc0a80057) returned 0x5700a8c0 [0080.540] socket (af=2, type=1, protocol=6) returned 0x44c [0080.540] ioctlsocket (in: s=0x44c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.540] connect (s=0x44c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.87"), namelen=16) returned -1 [0080.541] WSAGetLastError () returned 10035 [0080.541] htonl (hostlong=0xc0a80058) returned 0x5800a8c0 [0080.541] socket (af=2, type=1, protocol=6) returned 0x450 [0080.541] ioctlsocket (in: s=0x450, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.541] connect (s=0x450, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.88"), namelen=16) returned -1 [0080.542] WSAGetLastError () returned 10035 [0080.542] htonl (hostlong=0xc0a80059) returned 0x5900a8c0 [0080.542] socket (af=2, type=1, protocol=6) returned 0x454 [0080.542] ioctlsocket (in: s=0x454, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.542] connect (s=0x454, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.89"), namelen=16) returned -1 [0080.543] WSAGetLastError () returned 10035 [0080.543] htonl (hostlong=0xc0a8005a) returned 0x5a00a8c0 [0080.543] socket (af=2, type=1, protocol=6) returned 0x458 [0080.543] ioctlsocket (in: s=0x458, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.543] connect (s=0x458, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.90"), namelen=16) returned -1 [0080.544] WSAGetLastError () returned 10035 [0080.544] htonl (hostlong=0xc0a8005b) returned 0x5b00a8c0 [0080.544] socket (af=2, type=1, protocol=6) returned 0x45c [0080.544] ioctlsocket (in: s=0x45c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.544] connect (s=0x45c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.91"), namelen=16) returned -1 [0080.546] WSAGetLastError () returned 10035 [0080.546] htonl (hostlong=0xc0a8005c) returned 0x5c00a8c0 [0080.546] socket (af=2, type=1, protocol=6) returned 0x460 [0080.546] ioctlsocket (in: s=0x460, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.546] connect (s=0x460, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.92"), namelen=16) returned -1 [0080.884] WSAGetLastError () returned 10035 [0080.884] htonl (hostlong=0xc0a8005d) returned 0x5d00a8c0 [0080.884] socket (af=2, type=1, protocol=6) returned 0x3dc [0080.885] ioctlsocket (in: s=0x3dc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.885] connect (s=0x3dc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.93"), namelen=16) returned -1 [0080.886] WSAGetLastError () returned 10035 [0080.886] htonl (hostlong=0xc0a8005e) returned 0x5e00a8c0 [0080.886] socket (af=2, type=1, protocol=6) returned 0x464 [0080.886] ioctlsocket (in: s=0x464, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.886] connect (s=0x464, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.94"), namelen=16) returned -1 [0080.887] WSAGetLastError () returned 10035 [0080.887] htonl (hostlong=0xc0a8005f) returned 0x5f00a8c0 [0080.887] socket (af=2, type=1, protocol=6) returned 0x468 [0080.887] ioctlsocket (in: s=0x468, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.887] connect (s=0x468, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.95"), namelen=16) returned -1 [0080.888] WSAGetLastError () returned 10035 [0080.888] htonl (hostlong=0xc0a80060) returned 0x6000a8c0 [0080.888] socket (af=2, type=1, protocol=6) returned 0x46c [0080.888] ioctlsocket (in: s=0x46c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.888] connect (s=0x46c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.96"), namelen=16) returned -1 [0080.889] WSAGetLastError () returned 10035 [0080.889] htonl (hostlong=0xc0a80061) returned 0x6100a8c0 [0080.889] socket (af=2, type=1, protocol=6) returned 0x470 [0080.889] ioctlsocket (in: s=0x470, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.889] connect (s=0x470, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.97"), namelen=16) returned -1 [0080.889] WSAGetLastError () returned 10035 [0080.889] htonl (hostlong=0xc0a80062) returned 0x6200a8c0 [0080.889] socket (af=2, type=1, protocol=6) returned 0x474 [0080.890] ioctlsocket (in: s=0x474, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.890] connect (s=0x474, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.98"), namelen=16) returned -1 [0080.890] WSAGetLastError () returned 10035 [0080.890] htonl (hostlong=0xc0a80063) returned 0x6300a8c0 [0080.890] socket (af=2, type=1, protocol=6) returned 0x478 [0080.890] ioctlsocket (in: s=0x478, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.891] connect (s=0x478, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.99"), namelen=16) returned -1 [0080.891] WSAGetLastError () returned 10035 [0080.891] htonl (hostlong=0xc0a80064) returned 0x6400a8c0 [0080.891] socket (af=2, type=1, protocol=6) returned 0x47c [0080.891] ioctlsocket (in: s=0x47c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.891] connect (s=0x47c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.100"), namelen=16) returned -1 [0080.892] WSAGetLastError () returned 10035 [0080.892] htonl (hostlong=0xc0a80065) returned 0x6500a8c0 [0080.892] socket (af=2, type=1, protocol=6) returned 0x480 [0080.892] ioctlsocket (in: s=0x480, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.892] connect (s=0x480, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.101"), namelen=16) returned -1 [0080.893] WSAGetLastError () returned 10035 [0080.893] htonl (hostlong=0xc0a80066) returned 0x6600a8c0 [0080.893] socket (af=2, type=1, protocol=6) returned 0x484 [0080.893] ioctlsocket (in: s=0x484, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.893] connect (s=0x484, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.102"), namelen=16) returned -1 [0080.894] WSAGetLastError () returned 10035 [0080.894] htonl (hostlong=0xc0a80067) returned 0x6700a8c0 [0080.894] socket (af=2, type=1, protocol=6) returned 0x488 [0080.894] ioctlsocket (in: s=0x488, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.894] connect (s=0x488, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.103"), namelen=16) returned -1 [0080.895] WSAGetLastError () returned 10035 [0080.895] htonl (hostlong=0xc0a80068) returned 0x6800a8c0 [0080.895] socket (af=2, type=1, protocol=6) returned 0x48c [0080.895] ioctlsocket (in: s=0x48c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.895] connect (s=0x48c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.104"), namelen=16) returned -1 [0080.896] WSAGetLastError () returned 10035 [0080.896] htonl (hostlong=0xc0a80069) returned 0x6900a8c0 [0080.896] socket (af=2, type=1, protocol=6) returned 0x490 [0080.896] ioctlsocket (in: s=0x490, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.896] connect (s=0x490, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.105"), namelen=16) returned -1 [0080.897] WSAGetLastError () returned 10035 [0080.897] htonl (hostlong=0xc0a8006a) returned 0x6a00a8c0 [0080.897] socket (af=2, type=1, protocol=6) returned 0x494 [0080.897] ioctlsocket (in: s=0x494, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.897] connect (s=0x494, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.106"), namelen=16) returned -1 [0080.898] WSAGetLastError () returned 10035 [0080.898] htonl (hostlong=0xc0a8006b) returned 0x6b00a8c0 [0080.898] socket (af=2, type=1, protocol=6) returned 0x498 [0080.898] ioctlsocket (in: s=0x498, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.898] connect (s=0x498, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.107"), namelen=16) returned -1 [0080.898] WSAGetLastError () returned 10035 [0080.898] htonl (hostlong=0xc0a8006c) returned 0x6c00a8c0 [0080.899] socket (af=2, type=1, protocol=6) returned 0x49c [0080.899] ioctlsocket (in: s=0x49c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.899] connect (s=0x49c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.108"), namelen=16) returned -1 [0080.899] WSAGetLastError () returned 10035 [0080.899] htonl (hostlong=0xc0a8006d) returned 0x6d00a8c0 [0080.899] socket (af=2, type=1, protocol=6) returned 0x4a0 [0080.900] ioctlsocket (in: s=0x4a0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.900] connect (s=0x4a0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.109"), namelen=16) returned -1 [0080.900] WSAGetLastError () returned 10035 [0080.900] htonl (hostlong=0xc0a8006e) returned 0x6e00a8c0 [0080.900] socket (af=2, type=1, protocol=6) returned 0x4a4 [0080.900] ioctlsocket (in: s=0x4a4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.900] connect (s=0x4a4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.110"), namelen=16) returned -1 [0080.901] WSAGetLastError () returned 10035 [0080.901] htonl (hostlong=0xc0a8006f) returned 0x6f00a8c0 [0080.901] socket (af=2, type=1, protocol=6) returned 0x4a8 [0080.901] ioctlsocket (in: s=0x4a8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.901] connect (s=0x4a8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.111"), namelen=16) returned -1 [0080.902] WSAGetLastError () returned 10035 [0080.902] htonl (hostlong=0xc0a80070) returned 0x7000a8c0 [0080.902] socket (af=2, type=1, protocol=6) returned 0x4ac [0080.902] ioctlsocket (in: s=0x4ac, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.902] connect (s=0x4ac, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.112"), namelen=16) returned -1 [0080.903] WSAGetLastError () returned 10035 [0080.903] htonl (hostlong=0xc0a80071) returned 0x7100a8c0 [0080.903] socket (af=2, type=1, protocol=6) returned 0x4b0 [0080.903] ioctlsocket (in: s=0x4b0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.903] connect (s=0x4b0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.113"), namelen=16) returned -1 [0080.904] WSAGetLastError () returned 10035 [0080.904] htonl (hostlong=0xc0a80072) returned 0x7200a8c0 [0080.904] socket (af=2, type=1, protocol=6) returned 0x4b4 [0080.904] ioctlsocket (in: s=0x4b4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.904] connect (s=0x4b4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.114"), namelen=16) returned -1 [0080.905] WSAGetLastError () returned 10035 [0080.905] htonl (hostlong=0xc0a80073) returned 0x7300a8c0 [0080.905] socket (af=2, type=1, protocol=6) returned 0x4b8 [0080.905] ioctlsocket (in: s=0x4b8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.905] connect (s=0x4b8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.115"), namelen=16) returned -1 [0080.906] WSAGetLastError () returned 10035 [0080.906] htonl (hostlong=0xc0a80074) returned 0x7400a8c0 [0080.906] socket (af=2, type=1, protocol=6) returned 0x4bc [0080.906] ioctlsocket (in: s=0x4bc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.906] connect (s=0x4bc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.116"), namelen=16) returned -1 [0080.906] WSAGetLastError () returned 10035 [0080.906] htonl (hostlong=0xc0a80075) returned 0x7500a8c0 [0080.906] socket (af=2, type=1, protocol=6) returned 0x4c0 [0080.907] ioctlsocket (in: s=0x4c0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.907] connect (s=0x4c0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.117"), namelen=16) returned -1 [0080.907] WSAGetLastError () returned 10035 [0080.907] htonl (hostlong=0xc0a80076) returned 0x7600a8c0 [0080.907] socket (af=2, type=1, protocol=6) returned 0x4c4 [0080.908] ioctlsocket (in: s=0x4c4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.908] connect (s=0x4c4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.118"), namelen=16) returned -1 [0080.908] WSAGetLastError () returned 10035 [0080.908] htonl (hostlong=0xc0a80077) returned 0x7700a8c0 [0080.908] socket (af=2, type=1, protocol=6) returned 0x4c8 [0080.908] ioctlsocket (in: s=0x4c8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.909] connect (s=0x4c8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.119"), namelen=16) returned -1 [0080.909] WSAGetLastError () returned 10035 [0080.909] htonl (hostlong=0xc0a80078) returned 0x7800a8c0 [0080.909] socket (af=2, type=1, protocol=6) returned 0x4cc [0080.909] ioctlsocket (in: s=0x4cc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.909] connect (s=0x4cc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.120"), namelen=16) returned -1 [0080.910] WSAGetLastError () returned 10035 [0080.910] htonl (hostlong=0xc0a80079) returned 0x7900a8c0 [0080.910] socket (af=2, type=1, protocol=6) returned 0x4d0 [0080.911] ioctlsocket (in: s=0x4d0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.911] connect (s=0x4d0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.121"), namelen=16) returned -1 [0080.911] WSAGetLastError () returned 10035 [0080.911] htonl (hostlong=0xc0a8007a) returned 0x7a00a8c0 [0080.911] socket (af=2, type=1, protocol=6) returned 0x4d4 [0080.911] ioctlsocket (in: s=0x4d4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.912] connect (s=0x4d4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.122"), namelen=16) returned -1 [0080.912] WSAGetLastError () returned 10035 [0080.912] htonl (hostlong=0xc0a8007b) returned 0x7b00a8c0 [0080.912] socket (af=2, type=1, protocol=6) returned 0x4d8 [0080.912] ioctlsocket (in: s=0x4d8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.912] connect (s=0x4d8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.123"), namelen=16) returned -1 [0080.913] WSAGetLastError () returned 10035 [0080.913] htonl (hostlong=0xc0a8007c) returned 0x7c00a8c0 [0080.913] socket (af=2, type=1, protocol=6) returned 0x4dc [0080.913] ioctlsocket (in: s=0x4dc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.913] connect (s=0x4dc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.124"), namelen=16) returned -1 [0080.914] WSAGetLastError () returned 10035 [0080.914] htonl (hostlong=0xc0a8007d) returned 0x7d00a8c0 [0080.914] socket (af=2, type=1, protocol=6) returned 0x4e0 [0080.914] ioctlsocket (in: s=0x4e0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.914] connect (s=0x4e0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.125"), namelen=16) returned -1 [0080.915] WSAGetLastError () returned 10035 [0080.915] htonl (hostlong=0xc0a8007e) returned 0x7e00a8c0 [0080.915] socket (af=2, type=1, protocol=6) returned 0x4e4 [0080.915] ioctlsocket (in: s=0x4e4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.915] connect (s=0x4e4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.126"), namelen=16) returned -1 [0080.916] WSAGetLastError () returned 10035 [0080.916] htonl (hostlong=0xc0a8007f) returned 0x7f00a8c0 [0080.916] socket (af=2, type=1, protocol=6) returned 0x4e8 [0080.916] ioctlsocket (in: s=0x4e8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.916] connect (s=0x4e8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.127"), namelen=16) returned -1 [0080.917] WSAGetLastError () returned 10035 [0080.917] htonl (hostlong=0xc0a80080) returned 0x8000a8c0 [0080.917] socket (af=2, type=1, protocol=6) returned 0x4ec [0080.917] ioctlsocket (in: s=0x4ec, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.917] connect (s=0x4ec, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.128"), namelen=16) returned -1 [0080.918] WSAGetLastError () returned 10035 [0080.918] htonl (hostlong=0xc0a80081) returned 0x8100a8c0 [0080.918] socket (af=2, type=1, protocol=6) returned 0x4f0 [0080.918] ioctlsocket (in: s=0x4f0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.918] connect (s=0x4f0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.129"), namelen=16) returned -1 [0080.919] WSAGetLastError () returned 10035 [0080.919] htonl (hostlong=0xc0a80082) returned 0x8200a8c0 [0080.919] socket (af=2, type=1, protocol=6) returned 0x4f4 [0080.919] ioctlsocket (in: s=0x4f4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.919] connect (s=0x4f4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.130"), namelen=16) returned -1 [0080.919] WSAGetLastError () returned 10035 [0080.919] htonl (hostlong=0xc0a80083) returned 0x8300a8c0 [0080.919] socket (af=2, type=1, protocol=6) returned 0x4f8 [0080.920] ioctlsocket (in: s=0x4f8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.920] connect (s=0x4f8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.131"), namelen=16) returned -1 [0080.920] WSAGetLastError () returned 10035 [0080.920] htonl (hostlong=0xc0a80084) returned 0x8400a8c0 [0080.920] socket (af=2, type=1, protocol=6) returned 0x4fc [0080.921] ioctlsocket (in: s=0x4fc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.921] connect (s=0x4fc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.132"), namelen=16) returned -1 [0080.921] WSAGetLastError () returned 10035 [0080.921] htonl (hostlong=0xc0a80085) returned 0x8500a8c0 [0080.921] socket (af=2, type=1, protocol=6) returned 0x500 [0080.921] ioctlsocket (in: s=0x500, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.921] connect (s=0x500, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.133"), namelen=16) returned -1 [0080.922] WSAGetLastError () returned 10035 [0080.922] htonl (hostlong=0xc0a80086) returned 0x8600a8c0 [0080.922] socket (af=2, type=1, protocol=6) returned 0x504 [0080.922] ioctlsocket (in: s=0x504, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.922] connect (s=0x504, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.134"), namelen=16) returned -1 [0080.923] WSAGetLastError () returned 10035 [0080.923] htonl (hostlong=0xc0a80087) returned 0x8700a8c0 [0080.923] socket (af=2, type=1, protocol=6) returned 0x508 [0080.923] ioctlsocket (in: s=0x508, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.923] connect (s=0x508, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.135"), namelen=16) returned -1 [0080.924] WSAGetLastError () returned 10035 [0080.924] htonl (hostlong=0xc0a80088) returned 0x8800a8c0 [0080.924] socket (af=2, type=1, protocol=6) returned 0x50c [0080.924] ioctlsocket (in: s=0x50c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.924] connect (s=0x50c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.136"), namelen=16) returned -1 [0080.925] WSAGetLastError () returned 10035 [0080.925] htonl (hostlong=0xc0a80089) returned 0x8900a8c0 [0080.925] socket (af=2, type=1, protocol=6) returned 0x510 [0080.925] ioctlsocket (in: s=0x510, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.925] connect (s=0x510, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.137"), namelen=16) returned -1 [0080.926] WSAGetLastError () returned 10035 [0080.926] htonl (hostlong=0xc0a8008a) returned 0x8a00a8c0 [0080.926] socket (af=2, type=1, protocol=6) returned 0x514 [0080.926] ioctlsocket (in: s=0x514, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.926] connect (s=0x514, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.138"), namelen=16) returned -1 [0080.927] WSAGetLastError () returned 10035 [0080.927] htonl (hostlong=0xc0a8008b) returned 0x8b00a8c0 [0080.927] socket (af=2, type=1, protocol=6) returned 0x518 [0080.927] ioctlsocket (in: s=0x518, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0080.927] connect (s=0x518, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.139"), namelen=16) returned -1 [0081.188] WSAGetLastError () returned 10035 [0081.190] htonl (hostlong=0xc0a8008c) returned 0x8c00a8c0 [0081.190] socket (af=2, type=1, protocol=6) returned 0x520 [0081.206] ioctlsocket (in: s=0x520, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.206] connect (s=0x520, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.140"), namelen=16) returned -1 [0081.207] WSAGetLastError () returned 10035 [0081.207] htonl (hostlong=0xc0a8008d) returned 0x8d00a8c0 [0081.207] socket (af=2, type=1, protocol=6) returned 0x524 [0081.207] ioctlsocket (in: s=0x524, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.207] connect (s=0x524, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.141"), namelen=16) returned -1 [0081.208] WSAGetLastError () returned 10035 [0081.208] htonl (hostlong=0xc0a8008e) returned 0x8e00a8c0 [0081.208] socket (af=2, type=1, protocol=6) returned 0x528 [0081.208] ioctlsocket (in: s=0x528, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.208] connect (s=0x528, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.142"), namelen=16) returned -1 [0081.209] WSAGetLastError () returned 10035 [0081.209] htonl (hostlong=0xc0a8008f) returned 0x8f00a8c0 [0081.209] socket (af=2, type=1, protocol=6) returned 0x52c [0081.209] ioctlsocket (in: s=0x52c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.209] connect (s=0x52c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.143"), namelen=16) returned -1 [0081.210] WSAGetLastError () returned 10035 [0081.210] htonl (hostlong=0xc0a80090) returned 0x9000a8c0 [0081.210] socket (af=2, type=1, protocol=6) returned 0x530 [0081.210] ioctlsocket (in: s=0x530, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.210] connect (s=0x530, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.144"), namelen=16) returned -1 [0081.210] WSAGetLastError () returned 10035 [0081.210] htonl (hostlong=0xc0a80091) returned 0x9100a8c0 [0081.210] socket (af=2, type=1, protocol=6) returned 0x534 [0081.211] ioctlsocket (in: s=0x534, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.211] connect (s=0x534, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.145"), namelen=16) returned -1 [0081.211] WSAGetLastError () returned 10035 [0081.211] htonl (hostlong=0xc0a80092) returned 0x9200a8c0 [0081.211] socket (af=2, type=1, protocol=6) returned 0x538 [0081.211] ioctlsocket (in: s=0x538, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.212] connect (s=0x538, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.146"), namelen=16) returned -1 [0081.212] WSAGetLastError () returned 10035 [0081.212] htonl (hostlong=0xc0a80093) returned 0x9300a8c0 [0081.212] socket (af=2, type=1, protocol=6) returned 0x53c [0081.212] ioctlsocket (in: s=0x53c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.212] connect (s=0x53c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.147"), namelen=16) returned -1 [0081.213] WSAGetLastError () returned 10035 [0081.213] htonl (hostlong=0xc0a80094) returned 0x9400a8c0 [0081.213] socket (af=2, type=1, protocol=6) returned 0x540 [0081.213] ioctlsocket (in: s=0x540, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.213] connect (s=0x540, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.148"), namelen=16) returned -1 [0081.214] WSAGetLastError () returned 10035 [0081.214] htonl (hostlong=0xc0a80095) returned 0x9500a8c0 [0081.214] socket (af=2, type=1, protocol=6) returned 0x544 [0081.214] ioctlsocket (in: s=0x544, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.214] connect (s=0x544, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.149"), namelen=16) returned -1 [0081.215] WSAGetLastError () returned 10035 [0081.215] htonl (hostlong=0xc0a80096) returned 0x9600a8c0 [0081.215] socket (af=2, type=1, protocol=6) returned 0x548 [0081.215] ioctlsocket (in: s=0x548, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.215] connect (s=0x548, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.150"), namelen=16) returned -1 [0081.216] WSAGetLastError () returned 10035 [0081.216] htonl (hostlong=0xc0a80097) returned 0x9700a8c0 [0081.216] socket (af=2, type=1, protocol=6) returned 0x54c [0081.216] ioctlsocket (in: s=0x54c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.216] connect (s=0x54c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.151"), namelen=16) returned -1 [0081.217] WSAGetLastError () returned 10035 [0081.217] htonl (hostlong=0xc0a80098) returned 0x9800a8c0 [0081.217] socket (af=2, type=1, protocol=6) returned 0x550 [0081.217] ioctlsocket (in: s=0x550, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.217] connect (s=0x550, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.152"), namelen=16) returned -1 [0081.218] WSAGetLastError () returned 10035 [0081.218] htonl (hostlong=0xc0a80099) returned 0x9900a8c0 [0081.218] socket (af=2, type=1, protocol=6) returned 0x554 [0081.218] ioctlsocket (in: s=0x554, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.218] connect (s=0x554, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.153"), namelen=16) returned -1 [0081.219] WSAGetLastError () returned 10035 [0081.219] htonl (hostlong=0xc0a8009a) returned 0x9a00a8c0 [0081.219] socket (af=2, type=1, protocol=6) returned 0x558 [0081.219] ioctlsocket (in: s=0x558, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.219] connect (s=0x558, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.154"), namelen=16) returned -1 [0081.220] WSAGetLastError () returned 10035 [0081.220] htonl (hostlong=0xc0a8009b) returned 0x9b00a8c0 [0081.220] socket (af=2, type=1, protocol=6) returned 0x55c [0081.220] ioctlsocket (in: s=0x55c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.220] connect (s=0x55c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.155"), namelen=16) returned -1 [0081.221] WSAGetLastError () returned 10035 [0081.221] htonl (hostlong=0xc0a8009c) returned 0x9c00a8c0 [0081.221] socket (af=2, type=1, protocol=6) returned 0x560 [0081.221] ioctlsocket (in: s=0x560, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.221] connect (s=0x560, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.156"), namelen=16) returned -1 [0081.221] WSAGetLastError () returned 10035 [0081.221] htonl (hostlong=0xc0a8009d) returned 0x9d00a8c0 [0081.221] socket (af=2, type=1, protocol=6) returned 0x564 [0081.222] ioctlsocket (in: s=0x564, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.222] connect (s=0x564, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.157"), namelen=16) returned -1 [0081.223] WSAGetLastError () returned 10035 [0081.223] htonl (hostlong=0xc0a8009e) returned 0x9e00a8c0 [0081.223] socket (af=2, type=1, protocol=6) returned 0x568 [0081.223] ioctlsocket (in: s=0x568, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.223] connect (s=0x568, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.158"), namelen=16) returned -1 [0081.223] WSAGetLastError () returned 10035 [0081.223] htonl (hostlong=0xc0a8009f) returned 0x9f00a8c0 [0081.223] socket (af=2, type=1, protocol=6) returned 0x56c [0081.224] ioctlsocket (in: s=0x56c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.224] connect (s=0x56c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.159"), namelen=16) returned -1 [0081.224] WSAGetLastError () returned 10035 [0081.224] htonl (hostlong=0xc0a800a0) returned 0xa000a8c0 [0081.224] socket (af=2, type=1, protocol=6) returned 0x570 [0081.225] ioctlsocket (in: s=0x570, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.225] connect (s=0x570, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.160"), namelen=16) returned -1 [0081.225] WSAGetLastError () returned 10035 [0081.225] htonl (hostlong=0xc0a800a1) returned 0xa100a8c0 [0081.225] socket (af=2, type=1, protocol=6) returned 0x574 [0081.225] ioctlsocket (in: s=0x574, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.225] connect (s=0x574, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.161"), namelen=16) returned -1 [0081.226] WSAGetLastError () returned 10035 [0081.226] htonl (hostlong=0xc0a800a2) returned 0xa200a8c0 [0081.226] socket (af=2, type=1, protocol=6) returned 0x578 [0081.226] ioctlsocket (in: s=0x578, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.226] connect (s=0x578, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.162"), namelen=16) returned -1 [0081.227] WSAGetLastError () returned 10035 [0081.227] htonl (hostlong=0xc0a800a3) returned 0xa300a8c0 [0081.227] socket (af=2, type=1, protocol=6) returned 0x57c [0081.227] ioctlsocket (in: s=0x57c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.227] connect (s=0x57c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.163"), namelen=16) returned -1 [0081.228] WSAGetLastError () returned 10035 [0081.228] htonl (hostlong=0xc0a800a4) returned 0xa400a8c0 [0081.228] socket (af=2, type=1, protocol=6) returned 0x580 [0081.228] ioctlsocket (in: s=0x580, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.228] connect (s=0x580, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.164"), namelen=16) returned -1 [0081.229] WSAGetLastError () returned 10035 [0081.229] htonl (hostlong=0xc0a800a5) returned 0xa500a8c0 [0081.229] socket (af=2, type=1, protocol=6) returned 0x584 [0081.229] ioctlsocket (in: s=0x584, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.229] connect (s=0x584, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.165"), namelen=16) returned -1 [0081.230] WSAGetLastError () returned 10035 [0081.230] htonl (hostlong=0xc0a800a6) returned 0xa600a8c0 [0081.230] socket (af=2, type=1, protocol=6) returned 0x588 [0081.230] ioctlsocket (in: s=0x588, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.230] connect (s=0x588, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.166"), namelen=16) returned -1 [0081.230] WSAGetLastError () returned 10035 [0081.230] htonl (hostlong=0xc0a800a7) returned 0xa700a8c0 [0081.230] socket (af=2, type=1, protocol=6) returned 0x58c [0081.231] ioctlsocket (in: s=0x58c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.231] connect (s=0x58c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.167"), namelen=16) returned -1 [0081.231] WSAGetLastError () returned 10035 [0081.231] htonl (hostlong=0xc0a800a8) returned 0xa800a8c0 [0081.231] socket (af=2, type=1, protocol=6) returned 0x590 [0081.231] ioctlsocket (in: s=0x590, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.232] connect (s=0x590, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.168"), namelen=16) returned -1 [0081.232] WSAGetLastError () returned 10035 [0081.232] htonl (hostlong=0xc0a800a9) returned 0xa900a8c0 [0081.232] socket (af=2, type=1, protocol=6) returned 0x594 [0081.232] ioctlsocket (in: s=0x594, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.232] connect (s=0x594, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.169"), namelen=16) returned -1 [0081.233] WSAGetLastError () returned 10035 [0081.233] htonl (hostlong=0xc0a800aa) returned 0xaa00a8c0 [0081.233] socket (af=2, type=1, protocol=6) returned 0x598 [0081.233] ioctlsocket (in: s=0x598, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.233] connect (s=0x598, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.170"), namelen=16) returned -1 [0081.234] WSAGetLastError () returned 10035 [0081.234] htonl (hostlong=0xc0a800ab) returned 0xab00a8c0 [0081.234] socket (af=2, type=1, protocol=6) returned 0x59c [0081.234] ioctlsocket (in: s=0x59c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.234] connect (s=0x59c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.171"), namelen=16) returned -1 [0081.235] WSAGetLastError () returned 10035 [0081.235] htonl (hostlong=0xc0a800ac) returned 0xac00a8c0 [0081.235] socket (af=2, type=1, protocol=6) returned 0x5a0 [0081.235] ioctlsocket (in: s=0x5a0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.235] connect (s=0x5a0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.172"), namelen=16) returned -1 [0081.236] WSAGetLastError () returned 10035 [0081.236] htonl (hostlong=0xc0a800ad) returned 0xad00a8c0 [0081.236] socket (af=2, type=1, protocol=6) returned 0x5a4 [0081.236] ioctlsocket (in: s=0x5a4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.236] connect (s=0x5a4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.173"), namelen=16) returned -1 [0081.236] WSAGetLastError () returned 10035 [0081.236] htonl (hostlong=0xc0a800ae) returned 0xae00a8c0 [0081.236] socket (af=2, type=1, protocol=6) returned 0x5a8 [0081.237] ioctlsocket (in: s=0x5a8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.237] connect (s=0x5a8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.174"), namelen=16) returned -1 [0081.237] WSAGetLastError () returned 10035 [0081.237] htonl (hostlong=0xc0a800af) returned 0xaf00a8c0 [0081.237] socket (af=2, type=1, protocol=6) returned 0x5ac [0081.238] ioctlsocket (in: s=0x5ac, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.238] connect (s=0x5ac, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.175"), namelen=16) returned -1 [0081.238] WSAGetLastError () returned 10035 [0081.238] htonl (hostlong=0xc0a800b0) returned 0xb000a8c0 [0081.238] socket (af=2, type=1, protocol=6) returned 0x5b0 [0081.239] ioctlsocket (in: s=0x5b0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.239] connect (s=0x5b0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.176"), namelen=16) returned -1 [0081.239] WSAGetLastError () returned 10035 [0081.239] htonl (hostlong=0xc0a800b1) returned 0xb100a8c0 [0081.239] socket (af=2, type=1, protocol=6) returned 0x5b4 [0081.239] ioctlsocket (in: s=0x5b4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.239] connect (s=0x5b4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.177"), namelen=16) returned -1 [0081.240] WSAGetLastError () returned 10035 [0081.240] htonl (hostlong=0xc0a800b2) returned 0xb200a8c0 [0081.240] socket (af=2, type=1, protocol=6) returned 0x5b8 [0081.240] ioctlsocket (in: s=0x5b8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.240] connect (s=0x5b8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.178"), namelen=16) returned -1 [0081.241] WSAGetLastError () returned 10035 [0081.241] htonl (hostlong=0xc0a800b3) returned 0xb300a8c0 [0081.241] socket (af=2, type=1, protocol=6) returned 0x5bc [0081.241] ioctlsocket (in: s=0x5bc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.241] connect (s=0x5bc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.179"), namelen=16) returned -1 [0081.242] WSAGetLastError () returned 10035 [0081.242] htonl (hostlong=0xc0a800b4) returned 0xb400a8c0 [0081.242] socket (af=2, type=1, protocol=6) returned 0x5c0 [0081.242] ioctlsocket (in: s=0x5c0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.242] connect (s=0x5c0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.180"), namelen=16) returned -1 [0081.243] WSAGetLastError () returned 10035 [0081.243] htonl (hostlong=0xc0a800b5) returned 0xb500a8c0 [0081.243] socket (af=2, type=1, protocol=6) returned 0x5c4 [0081.243] ioctlsocket (in: s=0x5c4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.243] connect (s=0x5c4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.181"), namelen=16) returned -1 [0081.243] WSAGetLastError () returned 10035 [0081.243] htonl (hostlong=0xc0a800b6) returned 0xb600a8c0 [0081.243] socket (af=2, type=1, protocol=6) returned 0x5c8 [0081.244] ioctlsocket (in: s=0x5c8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.244] connect (s=0x5c8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.182"), namelen=16) returned -1 [0081.244] WSAGetLastError () returned 10035 [0081.244] htonl (hostlong=0xc0a800b7) returned 0xb700a8c0 [0081.244] socket (af=2, type=1, protocol=6) returned 0x5cc [0081.245] ioctlsocket (in: s=0x5cc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.245] connect (s=0x5cc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.183"), namelen=16) returned -1 [0081.245] WSAGetLastError () returned 10035 [0081.245] htonl (hostlong=0xc0a800b8) returned 0xb800a8c0 [0081.245] socket (af=2, type=1, protocol=6) returned 0x5d0 [0081.245] ioctlsocket (in: s=0x5d0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.246] connect (s=0x5d0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.184"), namelen=16) returned -1 [0081.246] WSAGetLastError () returned 10035 [0081.246] htonl (hostlong=0xc0a800b9) returned 0xb900a8c0 [0081.246] socket (af=2, type=1, protocol=6) returned 0x5d4 [0081.246] ioctlsocket (in: s=0x5d4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.246] connect (s=0x5d4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.185"), namelen=16) returned -1 [0081.247] WSAGetLastError () returned 10035 [0081.247] htonl (hostlong=0xc0a800ba) returned 0xba00a8c0 [0081.247] socket (af=2, type=1, protocol=6) returned 0x5d8 [0081.247] ioctlsocket (in: s=0x5d8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.247] connect (s=0x5d8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.186"), namelen=16) returned -1 [0081.249] WSAGetLastError () returned 10035 [0081.249] htonl (hostlong=0xc0a800bb) returned 0xbb00a8c0 [0081.249] socket (af=2, type=1, protocol=6) returned 0x5dc [0081.249] ioctlsocket (in: s=0x5dc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.249] connect (s=0x5dc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.187"), namelen=16) returned -1 [0081.250] WSAGetLastError () returned 10035 [0081.250] htonl (hostlong=0xc0a800bc) returned 0xbc00a8c0 [0081.250] socket (af=2, type=1, protocol=6) returned 0x5e0 [0081.250] ioctlsocket (in: s=0x5e0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.250] connect (s=0x5e0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.188"), namelen=16) returned -1 [0081.251] WSAGetLastError () returned 10035 [0081.251] htonl (hostlong=0xc0a800bd) returned 0xbd00a8c0 [0081.251] socket (af=2, type=1, protocol=6) returned 0x3d4 [0081.563] ioctlsocket (in: s=0x3d4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.565] connect (s=0x3d4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.189"), namelen=16) returned -1 [0081.577] WSAGetLastError () returned 10035 [0081.577] htonl (hostlong=0xc0a800be) returned 0xbe00a8c0 [0081.577] socket (af=2, type=1, protocol=6) returned 0x5e8 [0081.577] ioctlsocket (in: s=0x5e8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.577] connect (s=0x5e8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.190"), namelen=16) returned -1 [0081.577] WSAGetLastError () returned 10035 [0081.578] htonl (hostlong=0xc0a800bf) returned 0xbf00a8c0 [0081.578] socket (af=2, type=1, protocol=6) returned 0x5ec [0081.578] ioctlsocket (in: s=0x5ec, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.578] connect (s=0x5ec, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.191"), namelen=16) returned -1 [0081.578] WSAGetLastError () returned 10035 [0081.578] htonl (hostlong=0xc0a800c0) returned 0xc000a8c0 [0081.578] socket (af=2, type=1, protocol=6) returned 0x5f0 [0081.579] ioctlsocket (in: s=0x5f0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.579] connect (s=0x5f0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.192"), namelen=16) returned -1 [0081.579] WSAGetLastError () returned 10035 [0081.579] htonl (hostlong=0xc0a800c1) returned 0xc100a8c0 [0081.579] socket (af=2, type=1, protocol=6) returned 0x5f4 [0081.579] ioctlsocket (in: s=0x5f4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.579] connect (s=0x5f4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.193"), namelen=16) returned -1 [0081.580] WSAGetLastError () returned 10035 [0081.580] htonl (hostlong=0xc0a800c2) returned 0xc200a8c0 [0081.580] socket (af=2, type=1, protocol=6) returned 0x5f8 [0081.580] ioctlsocket (in: s=0x5f8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.580] connect (s=0x5f8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.194"), namelen=16) returned -1 [0081.581] WSAGetLastError () returned 10035 [0081.581] htonl (hostlong=0xc0a800c3) returned 0xc300a8c0 [0081.581] socket (af=2, type=1, protocol=6) returned 0x5fc [0081.581] ioctlsocket (in: s=0x5fc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.581] connect (s=0x5fc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.195"), namelen=16) returned -1 [0081.582] WSAGetLastError () returned 10035 [0081.582] htonl (hostlong=0xc0a800c4) returned 0xc400a8c0 [0081.582] socket (af=2, type=1, protocol=6) returned 0x600 [0081.582] ioctlsocket (in: s=0x600, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.582] connect (s=0x600, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.196"), namelen=16) returned -1 [0081.583] WSAGetLastError () returned 10035 [0081.583] htonl (hostlong=0xc0a800c5) returned 0xc500a8c0 [0081.583] socket (af=2, type=1, protocol=6) returned 0x604 [0081.583] ioctlsocket (in: s=0x604, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.583] connect (s=0x604, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.197"), namelen=16) returned -1 [0081.585] WSAGetLastError () returned 10035 [0081.585] htonl (hostlong=0xc0a800c6) returned 0xc600a8c0 [0081.585] socket (af=2, type=1, protocol=6) returned 0x608 [0081.586] ioctlsocket (in: s=0x608, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.586] connect (s=0x608, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.198"), namelen=16) returned -1 [0081.586] WSAGetLastError () returned 10035 [0081.586] htonl (hostlong=0xc0a800c7) returned 0xc700a8c0 [0081.586] socket (af=2, type=1, protocol=6) returned 0x60c [0081.587] ioctlsocket (in: s=0x60c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.587] connect (s=0x60c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.199"), namelen=16) returned -1 [0081.587] WSAGetLastError () returned 10035 [0081.587] htonl (hostlong=0xc0a800c8) returned 0xc800a8c0 [0081.587] socket (af=2, type=1, protocol=6) returned 0x610 [0081.588] ioctlsocket (in: s=0x610, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.588] connect (s=0x610, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.200"), namelen=16) returned -1 [0081.588] WSAGetLastError () returned 10035 [0081.588] htonl (hostlong=0xc0a800c9) returned 0xc900a8c0 [0081.588] socket (af=2, type=1, protocol=6) returned 0x614 [0081.588] ioctlsocket (in: s=0x614, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.588] connect (s=0x614, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.201"), namelen=16) returned -1 [0081.589] WSAGetLastError () returned 10035 [0081.590] htonl (hostlong=0xc0a800ca) returned 0xca00a8c0 [0081.590] socket (af=2, type=1, protocol=6) returned 0x618 [0081.590] ioctlsocket (in: s=0x618, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.590] connect (s=0x618, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.202"), namelen=16) returned -1 [0081.591] WSAGetLastError () returned 10035 [0081.591] htonl (hostlong=0xc0a800cb) returned 0xcb00a8c0 [0081.591] socket (af=2, type=1, protocol=6) returned 0x61c [0081.591] ioctlsocket (in: s=0x61c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.591] connect (s=0x61c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.203"), namelen=16) returned -1 [0081.592] WSAGetLastError () returned 10035 [0081.592] htonl (hostlong=0xc0a800cc) returned 0xcc00a8c0 [0081.592] socket (af=2, type=1, protocol=6) returned 0x620 [0081.592] ioctlsocket (in: s=0x620, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.592] connect (s=0x620, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.204"), namelen=16) returned -1 [0081.593] WSAGetLastError () returned 10035 [0081.593] htonl (hostlong=0xc0a800cd) returned 0xcd00a8c0 [0081.593] socket (af=2, type=1, protocol=6) returned 0x624 [0081.593] ioctlsocket (in: s=0x624, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.593] connect (s=0x624, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.205"), namelen=16) returned -1 [0081.594] WSAGetLastError () returned 10035 [0081.594] htonl (hostlong=0xc0a800ce) returned 0xce00a8c0 [0081.594] socket (af=2, type=1, protocol=6) returned 0x628 [0081.594] ioctlsocket (in: s=0x628, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.594] connect (s=0x628, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.206"), namelen=16) returned -1 [0081.594] WSAGetLastError () returned 10035 [0081.594] htonl (hostlong=0xc0a800cf) returned 0xcf00a8c0 [0081.594] socket (af=2, type=1, protocol=6) returned 0x62c [0081.595] ioctlsocket (in: s=0x62c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.595] connect (s=0x62c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.207"), namelen=16) returned -1 [0081.595] WSAGetLastError () returned 10035 [0081.595] htonl (hostlong=0xc0a800d0) returned 0xd000a8c0 [0081.595] socket (af=2, type=1, protocol=6) returned 0x630 [0081.596] ioctlsocket (in: s=0x630, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.596] connect (s=0x630, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.208"), namelen=16) returned -1 [0081.596] WSAGetLastError () returned 10035 [0081.596] htonl (hostlong=0xc0a800d1) returned 0xd100a8c0 [0081.596] socket (af=2, type=1, protocol=6) returned 0x634 [0081.596] ioctlsocket (in: s=0x634, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.596] connect (s=0x634, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.209"), namelen=16) returned -1 [0081.597] WSAGetLastError () returned 10035 [0081.597] htonl (hostlong=0xc0a800d2) returned 0xd200a8c0 [0081.597] socket (af=2, type=1, protocol=6) returned 0x638 [0081.597] ioctlsocket (in: s=0x638, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.597] connect (s=0x638, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.210"), namelen=16) returned -1 [0081.598] WSAGetLastError () returned 10035 [0081.598] htonl (hostlong=0xc0a800d3) returned 0xd300a8c0 [0081.598] socket (af=2, type=1, protocol=6) returned 0x63c [0081.598] ioctlsocket (in: s=0x63c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.598] connect (s=0x63c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.211"), namelen=16) returned -1 [0081.599] WSAGetLastError () returned 10035 [0081.599] htonl (hostlong=0xc0a800d4) returned 0xd400a8c0 [0081.599] socket (af=2, type=1, protocol=6) returned 0x640 [0081.599] ioctlsocket (in: s=0x640, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.599] connect (s=0x640, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.212"), namelen=16) returned -1 [0081.600] WSAGetLastError () returned 10035 [0081.600] htonl (hostlong=0xc0a800d5) returned 0xd500a8c0 [0081.600] socket (af=2, type=1, protocol=6) returned 0x644 [0081.600] ioctlsocket (in: s=0x644, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.600] connect (s=0x644, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.213"), namelen=16) returned -1 [0081.601] WSAGetLastError () returned 10035 [0081.601] htonl (hostlong=0xc0a800d6) returned 0xd600a8c0 [0081.601] socket (af=2, type=1, protocol=6) returned 0x648 [0081.601] ioctlsocket (in: s=0x648, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.601] connect (s=0x648, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.214"), namelen=16) returned -1 [0081.602] WSAGetLastError () returned 10035 [0081.602] htonl (hostlong=0xc0a800d7) returned 0xd700a8c0 [0081.602] socket (af=2, type=1, protocol=6) returned 0x64c [0081.602] ioctlsocket (in: s=0x64c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.602] connect (s=0x64c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.215"), namelen=16) returned -1 [0081.602] WSAGetLastError () returned 10035 [0081.602] htonl (hostlong=0xc0a800d8) returned 0xd800a8c0 [0081.602] socket (af=2, type=1, protocol=6) returned 0x650 [0081.603] ioctlsocket (in: s=0x650, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.603] connect (s=0x650, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.216"), namelen=16) returned -1 [0081.603] WSAGetLastError () returned 10035 [0081.603] htonl (hostlong=0xc0a800d9) returned 0xd900a8c0 [0081.603] socket (af=2, type=1, protocol=6) returned 0x654 [0081.604] ioctlsocket (in: s=0x654, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.604] connect (s=0x654, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.217"), namelen=16) returned -1 [0081.604] WSAGetLastError () returned 10035 [0081.604] htonl (hostlong=0xc0a800da) returned 0xda00a8c0 [0081.604] socket (af=2, type=1, protocol=6) returned 0x658 [0081.605] ioctlsocket (in: s=0x658, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.605] connect (s=0x658, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.218"), namelen=16) returned -1 [0081.605] WSAGetLastError () returned 10035 [0081.605] htonl (hostlong=0xc0a800db) returned 0xdb00a8c0 [0081.605] socket (af=2, type=1, protocol=6) returned 0x65c [0081.605] ioctlsocket (in: s=0x65c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.605] connect (s=0x65c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.219"), namelen=16) returned -1 [0081.606] WSAGetLastError () returned 10035 [0081.606] htonl (hostlong=0xc0a800dc) returned 0xdc00a8c0 [0081.606] socket (af=2, type=1, protocol=6) returned 0x660 [0081.606] ioctlsocket (in: s=0x660, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.606] connect (s=0x660, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.220"), namelen=16) returned -1 [0081.607] WSAGetLastError () returned 10035 [0081.607] htonl (hostlong=0xc0a800dd) returned 0xdd00a8c0 [0081.607] socket (af=2, type=1, protocol=6) returned 0x664 [0081.608] ioctlsocket (in: s=0x664, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.608] connect (s=0x664, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.221"), namelen=16) returned -1 [0081.608] WSAGetLastError () returned 10035 [0081.608] htonl (hostlong=0xc0a800de) returned 0xde00a8c0 [0081.608] socket (af=2, type=1, protocol=6) returned 0x668 [0081.608] ioctlsocket (in: s=0x668, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.609] connect (s=0x668, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.222"), namelen=16) returned -1 [0081.609] WSAGetLastError () returned 10035 [0081.609] htonl (hostlong=0xc0a800df) returned 0xdf00a8c0 [0081.609] socket (af=2, type=1, protocol=6) returned 0x66c [0081.609] ioctlsocket (in: s=0x66c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.609] connect (s=0x66c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.223"), namelen=16) returned -1 [0081.610] WSAGetLastError () returned 10035 [0081.610] htonl (hostlong=0xc0a800e0) returned 0xe000a8c0 [0081.610] socket (af=2, type=1, protocol=6) returned 0x670 [0081.610] ioctlsocket (in: s=0x670, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.610] connect (s=0x670, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.224"), namelen=16) returned -1 [0081.611] WSAGetLastError () returned 10035 [0081.611] htonl (hostlong=0xc0a800e1) returned 0xe100a8c0 [0081.611] socket (af=2, type=1, protocol=6) returned 0x674 [0081.611] ioctlsocket (in: s=0x674, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.611] connect (s=0x674, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.225"), namelen=16) returned -1 [0081.612] WSAGetLastError () returned 10035 [0081.612] htonl (hostlong=0xc0a800e2) returned 0xe200a8c0 [0081.612] socket (af=2, type=1, protocol=6) returned 0x678 [0081.612] ioctlsocket (in: s=0x678, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.612] connect (s=0x678, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.226"), namelen=16) returned -1 [0081.613] WSAGetLastError () returned 10035 [0081.613] htonl (hostlong=0xc0a800e3) returned 0xe300a8c0 [0081.613] socket (af=2, type=1, protocol=6) returned 0x67c [0081.613] ioctlsocket (in: s=0x67c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.613] connect (s=0x67c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.227"), namelen=16) returned -1 [0081.614] WSAGetLastError () returned 10035 [0081.614] htonl (hostlong=0xc0a800e4) returned 0xe400a8c0 [0081.614] socket (af=2, type=1, protocol=6) returned 0x680 [0081.614] ioctlsocket (in: s=0x680, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.614] connect (s=0x680, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.228"), namelen=16) returned -1 [0081.615] WSAGetLastError () returned 10035 [0081.615] htonl (hostlong=0xc0a800e5) returned 0xe500a8c0 [0081.615] socket (af=2, type=1, protocol=6) returned 0x684 [0081.615] ioctlsocket (in: s=0x684, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.615] connect (s=0x684, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.229"), namelen=16) returned -1 [0081.702] WSAGetLastError () returned 10035 [0081.702] htonl (hostlong=0xc0a800e6) returned 0xe600a8c0 [0081.702] socket (af=2, type=1, protocol=6) returned 0x688 [0081.702] ioctlsocket (in: s=0x688, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.702] connect (s=0x688, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.230"), namelen=16) returned -1 [0081.703] WSAGetLastError () returned 10035 [0081.703] htonl (hostlong=0xc0a800e7) returned 0xe700a8c0 [0081.703] socket (af=2, type=1, protocol=6) returned 0x68c [0081.703] ioctlsocket (in: s=0x68c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.703] connect (s=0x68c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.231"), namelen=16) returned -1 [0081.704] WSAGetLastError () returned 10035 [0081.704] htonl (hostlong=0xc0a800e8) returned 0xe800a8c0 [0081.704] socket (af=2, type=1, protocol=6) returned 0x690 [0081.704] ioctlsocket (in: s=0x690, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.704] connect (s=0x690, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.232"), namelen=16) returned -1 [0081.705] WSAGetLastError () returned 10035 [0081.705] htonl (hostlong=0xc0a800e9) returned 0xe900a8c0 [0081.705] socket (af=2, type=1, protocol=6) returned 0x694 [0081.705] ioctlsocket (in: s=0x694, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.705] connect (s=0x694, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.233"), namelen=16) returned -1 [0081.706] WSAGetLastError () returned 10035 [0081.706] htonl (hostlong=0xc0a800ea) returned 0xea00a8c0 [0081.706] socket (af=2, type=1, protocol=6) returned 0x698 [0081.706] ioctlsocket (in: s=0x698, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.706] connect (s=0x698, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.234"), namelen=16) returned -1 [0081.707] WSAGetLastError () returned 10035 [0081.707] htonl (hostlong=0xc0a800eb) returned 0xeb00a8c0 [0081.707] socket (af=2, type=1, protocol=6) returned 0x69c [0081.707] ioctlsocket (in: s=0x69c, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.707] connect (s=0x69c, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.235"), namelen=16) returned -1 [0081.708] WSAGetLastError () returned 10035 [0081.708] htonl (hostlong=0xc0a800ec) returned 0xec00a8c0 [0081.708] socket (af=2, type=1, protocol=6) returned 0x6a0 [0081.708] ioctlsocket (in: s=0x6a0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.708] connect (s=0x6a0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.236"), namelen=16) returned -1 [0081.709] WSAGetLastError () returned 10035 [0081.709] htonl (hostlong=0xc0a800ed) returned 0xed00a8c0 [0081.709] socket (af=2, type=1, protocol=6) returned 0x6a4 [0081.709] ioctlsocket (in: s=0x6a4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.709] connect (s=0x6a4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.237"), namelen=16) returned -1 [0081.710] WSAGetLastError () returned 10035 [0081.710] htonl (hostlong=0xc0a800ee) returned 0xee00a8c0 [0081.710] socket (af=2, type=1, protocol=6) returned 0x6a8 [0081.710] ioctlsocket (in: s=0x6a8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.710] connect (s=0x6a8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.238"), namelen=16) returned -1 [0081.710] WSAGetLastError () returned 10035 [0081.710] htonl (hostlong=0xc0a800ef) returned 0xef00a8c0 [0081.710] socket (af=2, type=1, protocol=6) returned 0x6ac [0081.711] ioctlsocket (in: s=0x6ac, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.711] connect (s=0x6ac, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.239"), namelen=16) returned -1 [0081.711] WSAGetLastError () returned 10035 [0081.711] htonl (hostlong=0xc0a800f0) returned 0xf000a8c0 [0081.711] socket (af=2, type=1, protocol=6) returned 0x6b0 [0081.712] ioctlsocket (in: s=0x6b0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.712] connect (s=0x6b0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.240"), namelen=16) returned -1 [0081.712] WSAGetLastError () returned 10035 [0081.712] htonl (hostlong=0xc0a800f1) returned 0xf100a8c0 [0081.712] socket (af=2, type=1, protocol=6) returned 0x6b4 [0081.712] ioctlsocket (in: s=0x6b4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.713] connect (s=0x6b4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.241"), namelen=16) returned -1 [0081.713] WSAGetLastError () returned 10035 [0081.713] htonl (hostlong=0xc0a800f2) returned 0xf200a8c0 [0081.713] socket (af=2, type=1, protocol=6) returned 0x6b8 [0081.714] ioctlsocket (in: s=0x6b8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.714] connect (s=0x6b8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.242"), namelen=16) returned -1 [0081.714] WSAGetLastError () returned 10035 [0081.714] htonl (hostlong=0xc0a800f3) returned 0xf300a8c0 [0081.714] socket (af=2, type=1, protocol=6) returned 0x6bc [0081.714] ioctlsocket (in: s=0x6bc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.714] connect (s=0x6bc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.243"), namelen=16) returned -1 [0081.715] WSAGetLastError () returned 10035 [0081.715] htonl (hostlong=0xc0a800f4) returned 0xf400a8c0 [0081.715] socket (af=2, type=1, protocol=6) returned 0x6c0 [0081.715] ioctlsocket (in: s=0x6c0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.715] connect (s=0x6c0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.244"), namelen=16) returned -1 [0081.716] WSAGetLastError () returned 10035 [0081.716] htonl (hostlong=0xc0a800f5) returned 0xf500a8c0 [0081.716] socket (af=2, type=1, protocol=6) returned 0x6c4 [0081.716] ioctlsocket (in: s=0x6c4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.716] connect (s=0x6c4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.245"), namelen=16) returned -1 [0081.718] WSAGetLastError () returned 10035 [0081.718] htonl (hostlong=0xc0a800f6) returned 0xf600a8c0 [0081.718] socket (af=2, type=1, protocol=6) returned 0x6c8 [0081.718] ioctlsocket (in: s=0x6c8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.718] connect (s=0x6c8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.246"), namelen=16) returned -1 [0081.718] WSAGetLastError () returned 10035 [0081.718] htonl (hostlong=0xc0a800f7) returned 0xf700a8c0 [0081.719] socket (af=2, type=1, protocol=6) returned 0x6cc [0081.719] ioctlsocket (in: s=0x6cc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.719] connect (s=0x6cc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.247"), namelen=16) returned -1 [0081.719] WSAGetLastError () returned 10035 [0081.719] htonl (hostlong=0xc0a800f8) returned 0xf800a8c0 [0081.719] socket (af=2, type=1, protocol=6) returned 0x6d0 [0081.720] ioctlsocket (in: s=0x6d0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.720] connect (s=0x6d0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.248"), namelen=16) returned -1 [0081.720] WSAGetLastError () returned 10035 [0081.720] htonl (hostlong=0xc0a800f9) returned 0xf900a8c0 [0081.720] socket (af=2, type=1, protocol=6) returned 0x6d4 [0081.720] ioctlsocket (in: s=0x6d4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.721] connect (s=0x6d4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.249"), namelen=16) returned -1 [0081.721] WSAGetLastError () returned 10035 [0081.721] htonl (hostlong=0xc0a800fa) returned 0xfa00a8c0 [0081.721] socket (af=2, type=1, protocol=6) returned 0x6d8 [0081.721] ioctlsocket (in: s=0x6d8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.721] connect (s=0x6d8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.250"), namelen=16) returned -1 [0081.722] WSAGetLastError () returned 10035 [0081.722] htonl (hostlong=0xc0a800fb) returned 0xfb00a8c0 [0081.722] socket (af=2, type=1, protocol=6) returned 0x6dc [0081.723] ioctlsocket (in: s=0x6dc, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.723] connect (s=0x6dc, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.251"), namelen=16) returned -1 [0081.723] WSAGetLastError () returned 10035 [0081.723] htonl (hostlong=0xc0a800fc) returned 0xfc00a8c0 [0081.723] socket (af=2, type=1, protocol=6) returned 0x6e0 [0081.723] ioctlsocket (in: s=0x6e0, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.723] connect (s=0x6e0, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.252"), namelen=16) returned -1 [0081.724] WSAGetLastError () returned 10035 [0081.724] htonl (hostlong=0xc0a800fd) returned 0xfd00a8c0 [0081.724] socket (af=2, type=1, protocol=6) returned 0x6e4 [0081.724] ioctlsocket (in: s=0x6e4, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.724] connect (s=0x6e4, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.253"), namelen=16) returned -1 [0081.725] WSAGetLastError () returned 10035 [0081.725] htonl (hostlong=0xc0a800fe) returned 0xfe00a8c0 [0081.725] socket (af=2, type=1, protocol=6) returned 0x6e8 [0081.725] ioctlsocket (in: s=0x6e8, cmd=-2147195266, argp=0x1ecdfec8 | out: argp=0x1ecdfec8) returned 0 [0081.725] connect (s=0x6e8, name=0x1ecdfeb0*(sa_family=2, sin_port=0x1bd, sin_addr="192.168.0.254"), namelen=16) returned -1 [0081.726] WSAGetLastError () returned 10035 [0081.726] GetTickCount () returned 0x1154c19 [0081.726] GetTickCount () returned 0x1154c19 [0081.726] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.726] GetTickCount () returned 0x1154c19 [0081.726] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.726] GetTickCount () returned 0x1154c19 [0081.726] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.726] GetTickCount () returned 0x1154c19 [0081.726] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.727] GetTickCount () returned 0x1154c19 [0081.727] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.728] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.728] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.729] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.729] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.730] GetTickCount () returned 0x1154c19 [0081.730] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.731] GetTickCount () returned 0x1154c19 [0081.731] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.732] GetTickCount () returned 0x1154c19 [0081.732] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.733] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.733] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.734] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.734] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.735] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.735] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.736] GetTickCount () returned 0x1154c19 [0081.736] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.737] GetTickCount () returned 0x1154c19 [0081.737] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c19 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c19 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c19 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c19 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c19 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c28 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c28 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c28 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c28 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c28 [0081.738] select (in: nfds=0, readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60, timeout=0x1ecdfe70 | out: readfds=0x1ecdfd68, writefds=0x0, exceptfds=0x1ecdfc60) returned -1 [0081.738] GetTickCount () returned 0x1154c28 [0081.738] getsockopt (in: s=0x6e8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.738] recv (in: s=0x6e8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.739] WSAGetLastError () returned 10057 [0081.739] closesocket (s=0x6e8) returned 0 [0081.739] getsockopt (in: s=0x6e4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.739] recv (in: s=0x6e4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.739] WSAGetLastError () returned 10057 [0081.739] closesocket (s=0x6e4) returned 0 [0081.740] getsockopt (in: s=0x6e0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.740] recv (in: s=0x6e0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.740] WSAGetLastError () returned 10057 [0081.740] closesocket (s=0x6e0) returned 0 [0081.740] getsockopt (in: s=0x6dc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.740] recv (in: s=0x6dc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.740] WSAGetLastError () returned 10057 [0081.740] closesocket (s=0x6dc) returned 0 [0081.740] getsockopt (in: s=0x6d8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.740] recv (in: s=0x6d8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.740] WSAGetLastError () returned 10057 [0081.740] closesocket (s=0x6d8) returned 0 [0081.741] getsockopt (in: s=0x6d4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.741] recv (in: s=0x6d4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.741] WSAGetLastError () returned 10057 [0081.741] closesocket (s=0x6d4) returned 0 [0081.741] getsockopt (in: s=0x6d0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.741] recv (in: s=0x6d0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.741] WSAGetLastError () returned 10057 [0081.741] closesocket (s=0x6d0) returned 0 [0081.741] getsockopt (in: s=0x6cc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.741] recv (in: s=0x6cc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.741] WSAGetLastError () returned 10057 [0081.741] closesocket (s=0x6cc) returned 0 [0081.742] getsockopt (in: s=0x6c8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.742] recv (in: s=0x6c8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.742] WSAGetLastError () returned 10057 [0081.742] closesocket (s=0x6c8) returned 0 [0081.742] getsockopt (in: s=0x6c4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0081.742] recv (in: s=0x6c4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0081.742] WSAGetLastError () returned 10057 [0081.742] closesocket (s=0x6c4) returned 0 [0082.532] getsockopt (in: s=0x6c0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.532] recv (in: s=0x6c0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.532] WSAGetLastError () returned 10057 [0082.532] closesocket (s=0x6c0) returned 0 [0082.532] getsockopt (in: s=0x6bc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.532] recv (in: s=0x6bc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.532] WSAGetLastError () returned 10057 [0082.532] closesocket (s=0x6bc) returned 0 [0082.533] getsockopt (in: s=0x6b8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.533] recv (in: s=0x6b8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.533] WSAGetLastError () returned 10057 [0082.533] closesocket (s=0x6b8) returned 0 [0082.533] getsockopt (in: s=0x6b4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.533] recv (in: s=0x6b4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.533] WSAGetLastError () returned 10057 [0082.533] closesocket (s=0x6b4) returned 0 [0082.533] getsockopt (in: s=0x6b0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.533] recv (in: s=0x6b0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.533] WSAGetLastError () returned 10057 [0082.533] closesocket (s=0x6b0) returned 0 [0082.534] getsockopt (in: s=0x6ac, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.534] recv (in: s=0x6ac, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.534] WSAGetLastError () returned 10057 [0082.534] closesocket (s=0x6ac) returned 0 [0082.534] getsockopt (in: s=0x6a8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.534] recv (in: s=0x6a8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.534] WSAGetLastError () returned 10057 [0082.534] closesocket (s=0x6a8) returned 0 [0082.534] getsockopt (in: s=0x6a4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.534] recv (in: s=0x6a4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.534] WSAGetLastError () returned 10057 [0082.534] closesocket (s=0x6a4) returned 0 [0082.535] getsockopt (in: s=0x6a0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.535] recv (in: s=0x6a0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.535] WSAGetLastError () returned 10057 [0082.535] closesocket (s=0x6a0) returned 0 [0082.538] getsockopt (in: s=0x69c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.538] recv (in: s=0x69c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.538] WSAGetLastError () returned 10057 [0082.538] closesocket (s=0x69c) returned 0 [0082.538] getsockopt (in: s=0x698, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.538] recv (in: s=0x698, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.538] WSAGetLastError () returned 10057 [0082.539] closesocket (s=0x698) returned 0 [0082.539] getsockopt (in: s=0x694, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.539] recv (in: s=0x694, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.539] WSAGetLastError () returned 10057 [0082.539] closesocket (s=0x694) returned 0 [0082.539] getsockopt (in: s=0x690, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.539] recv (in: s=0x690, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.539] WSAGetLastError () returned 10057 [0082.539] closesocket (s=0x690) returned 0 [0082.539] getsockopt (in: s=0x68c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.539] recv (in: s=0x68c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.540] WSAGetLastError () returned 10057 [0082.540] closesocket (s=0x68c) returned 0 [0082.540] getsockopt (in: s=0x688, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.540] recv (in: s=0x688, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.540] WSAGetLastError () returned 10057 [0082.540] closesocket (s=0x688) returned 0 [0082.540] getsockopt (in: s=0x684, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.540] recv (in: s=0x684, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.540] WSAGetLastError () returned 10057 [0082.540] closesocket (s=0x684) returned 0 [0082.540] getsockopt (in: s=0x680, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.540] recv (in: s=0x680, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.540] WSAGetLastError () returned 10057 [0082.541] closesocket (s=0x680) returned 0 [0082.541] getsockopt (in: s=0x67c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.541] recv (in: s=0x67c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.541] WSAGetLastError () returned 10057 [0082.541] closesocket (s=0x67c) returned 0 [0082.541] getsockopt (in: s=0x678, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.541] recv (in: s=0x678, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.541] WSAGetLastError () returned 10057 [0082.541] closesocket (s=0x678) returned 0 [0082.541] getsockopt (in: s=0x674, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.541] recv (in: s=0x674, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.541] WSAGetLastError () returned 10057 [0082.541] closesocket (s=0x674) returned 0 [0082.542] getsockopt (in: s=0x670, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.542] recv (in: s=0x670, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.542] WSAGetLastError () returned 10057 [0082.542] closesocket (s=0x670) returned 0 [0082.542] getsockopt (in: s=0x66c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.542] recv (in: s=0x66c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.542] WSAGetLastError () returned 10057 [0082.542] closesocket (s=0x66c) returned 0 [0082.542] getsockopt (in: s=0x668, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.542] recv (in: s=0x668, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.542] WSAGetLastError () returned 10057 [0082.542] closesocket (s=0x668) returned 0 [0082.543] getsockopt (in: s=0x664, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.543] recv (in: s=0x664, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.543] WSAGetLastError () returned 10057 [0082.543] closesocket (s=0x664) returned 0 [0082.543] getsockopt (in: s=0x660, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.543] recv (in: s=0x660, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.543] WSAGetLastError () returned 10057 [0082.543] closesocket (s=0x660) returned 0 [0082.543] getsockopt (in: s=0x65c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.543] recv (in: s=0x65c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.543] WSAGetLastError () returned 10057 [0082.543] closesocket (s=0x65c) returned 0 [0082.544] getsockopt (in: s=0x658, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.544] recv (in: s=0x658, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.544] WSAGetLastError () returned 10057 [0082.544] closesocket (s=0x658) returned 0 [0082.544] getsockopt (in: s=0x654, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.544] recv (in: s=0x654, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.544] WSAGetLastError () returned 10057 [0082.544] closesocket (s=0x654) returned 0 [0082.544] getsockopt (in: s=0x650, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.544] recv (in: s=0x650, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.544] WSAGetLastError () returned 10057 [0082.544] closesocket (s=0x650) returned 0 [0082.545] getsockopt (in: s=0x64c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.545] recv (in: s=0x64c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.545] WSAGetLastError () returned 10057 [0082.545] closesocket (s=0x64c) returned 0 [0082.545] getsockopt (in: s=0x648, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.545] recv (in: s=0x648, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.545] WSAGetLastError () returned 10057 [0082.545] closesocket (s=0x648) returned 0 [0082.545] getsockopt (in: s=0x644, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.545] recv (in: s=0x644, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.545] WSAGetLastError () returned 10057 [0082.545] closesocket (s=0x644) returned 0 [0082.546] getsockopt (in: s=0x640, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.546] recv (in: s=0x640, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.546] WSAGetLastError () returned 10057 [0082.546] closesocket (s=0x640) returned 0 [0082.546] getsockopt (in: s=0x63c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.546] recv (in: s=0x63c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.546] WSAGetLastError () returned 10057 [0082.546] closesocket (s=0x63c) returned 0 [0082.546] getsockopt (in: s=0x638, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.546] recv (in: s=0x638, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.546] WSAGetLastError () returned 10057 [0082.546] closesocket (s=0x638) returned 0 [0082.547] getsockopt (in: s=0x634, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.547] recv (in: s=0x634, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.547] WSAGetLastError () returned 10057 [0082.547] closesocket (s=0x634) returned 0 [0082.547] getsockopt (in: s=0x630, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.547] recv (in: s=0x630, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.547] WSAGetLastError () returned 10057 [0082.547] closesocket (s=0x630) returned 0 [0082.548] getsockopt (in: s=0x62c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.548] recv (in: s=0x62c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.548] WSAGetLastError () returned 10057 [0082.548] closesocket (s=0x62c) returned 0 [0082.548] getsockopt (in: s=0x628, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.548] recv (in: s=0x628, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.548] WSAGetLastError () returned 10057 [0082.548] closesocket (s=0x628) returned 0 [0082.548] getsockopt (in: s=0x624, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.548] recv (in: s=0x624, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.548] WSAGetLastError () returned 10057 [0082.548] closesocket (s=0x624) returned 0 [0082.549] getsockopt (in: s=0x620, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.549] recv (in: s=0x620, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.549] WSAGetLastError () returned 10057 [0082.549] closesocket (s=0x620) returned 0 [0082.549] getsockopt (in: s=0x61c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.549] recv (in: s=0x61c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.549] WSAGetLastError () returned 10057 [0082.549] closesocket (s=0x61c) returned 0 [0082.549] getsockopt (in: s=0x618, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.549] recv (in: s=0x618, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.549] WSAGetLastError () returned 10057 [0082.549] closesocket (s=0x618) returned 0 [0082.550] getsockopt (in: s=0x614, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.550] recv (in: s=0x614, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.550] WSAGetLastError () returned 10057 [0082.550] closesocket (s=0x614) returned 0 [0082.550] getsockopt (in: s=0x610, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.550] recv (in: s=0x610, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.550] WSAGetLastError () returned 10057 [0082.550] closesocket (s=0x610) returned 0 [0082.552] getsockopt (in: s=0x60c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.552] recv (in: s=0x60c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.552] WSAGetLastError () returned 10057 [0082.552] closesocket (s=0x60c) returned 0 [0082.552] getsockopt (in: s=0x608, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.552] recv (in: s=0x608, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.552] WSAGetLastError () returned 10057 [0082.552] closesocket (s=0x608) returned 0 [0082.552] getsockopt (in: s=0x604, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.552] recv (in: s=0x604, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.552] WSAGetLastError () returned 10057 [0082.552] closesocket (s=0x604) returned 0 [0082.553] getsockopt (in: s=0x600, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.553] recv (in: s=0x600, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.553] WSAGetLastError () returned 10057 [0082.553] closesocket (s=0x600) returned 0 [0082.553] getsockopt (in: s=0x5fc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.553] recv (in: s=0x5fc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.553] WSAGetLastError () returned 10057 [0082.553] closesocket (s=0x5fc) returned 0 [0082.553] getsockopt (in: s=0x5f8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.553] recv (in: s=0x5f8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.553] WSAGetLastError () returned 10057 [0082.553] closesocket (s=0x5f8) returned 0 [0082.554] getsockopt (in: s=0x5f4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.554] recv (in: s=0x5f4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.554] WSAGetLastError () returned 10057 [0082.554] closesocket (s=0x5f4) returned 0 [0082.554] getsockopt (in: s=0x5f0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.554] recv (in: s=0x5f0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.554] WSAGetLastError () returned 10057 [0082.554] closesocket (s=0x5f0) returned 0 [0082.554] getsockopt (in: s=0x5ec, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.554] recv (in: s=0x5ec, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.554] WSAGetLastError () returned 10057 [0082.554] closesocket (s=0x5ec) returned 0 [0082.555] getsockopt (in: s=0x5e8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.555] recv (in: s=0x5e8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.555] WSAGetLastError () returned 10057 [0082.555] closesocket (s=0x5e8) returned 0 [0082.555] getsockopt (in: s=0x3d4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.555] recv (in: s=0x3d4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.555] WSAGetLastError () returned 10057 [0082.555] closesocket (s=0x3d4) returned 0 [0082.555] getsockopt (in: s=0x5e0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.555] recv (in: s=0x5e0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.555] WSAGetLastError () returned 10057 [0082.555] closesocket (s=0x5e0) returned 0 [0082.556] getsockopt (in: s=0x5dc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.556] recv (in: s=0x5dc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.556] WSAGetLastError () returned 10057 [0082.556] closesocket (s=0x5dc) returned 0 [0082.556] getsockopt (in: s=0x5d8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.556] recv (in: s=0x5d8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.556] WSAGetLastError () returned 10057 [0082.556] closesocket (s=0x5d8) returned 0 [0082.556] getsockopt (in: s=0x5d4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.556] recv (in: s=0x5d4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.556] WSAGetLastError () returned 10057 [0082.556] closesocket (s=0x5d4) returned 0 [0082.557] getsockopt (in: s=0x5d0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.557] recv (in: s=0x5d0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.557] WSAGetLastError () returned 10057 [0082.557] closesocket (s=0x5d0) returned 0 [0082.557] getsockopt (in: s=0x5cc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.557] recv (in: s=0x5cc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.557] WSAGetLastError () returned 10057 [0082.557] closesocket (s=0x5cc) returned 0 [0082.557] getsockopt (in: s=0x5c8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.557] recv (in: s=0x5c8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.557] WSAGetLastError () returned 10057 [0082.557] closesocket (s=0x5c8) returned 0 [0082.558] getsockopt (in: s=0x5c4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.558] recv (in: s=0x5c4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.558] WSAGetLastError () returned 10057 [0082.558] closesocket (s=0x5c4) returned 0 [0082.558] getsockopt (in: s=0x5c0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.558] recv (in: s=0x5c0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.558] WSAGetLastError () returned 10057 [0082.558] closesocket (s=0x5c0) returned 0 [0082.558] getsockopt (in: s=0x5bc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.558] recv (in: s=0x5bc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.558] WSAGetLastError () returned 10057 [0082.558] closesocket (s=0x5bc) returned 0 [0082.558] getsockopt (in: s=0x5b8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.559] recv (in: s=0x5b8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.559] WSAGetLastError () returned 10057 [0082.559] closesocket (s=0x5b8) returned 0 [0082.559] getsockopt (in: s=0x5b4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.559] recv (in: s=0x5b4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.559] WSAGetLastError () returned 10057 [0082.559] closesocket (s=0x5b4) returned 0 [0082.559] getsockopt (in: s=0x5b0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.559] recv (in: s=0x5b0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.559] WSAGetLastError () returned 10057 [0082.559] closesocket (s=0x5b0) returned 0 [0082.559] getsockopt (in: s=0x5ac, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.559] recv (in: s=0x5ac, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.560] WSAGetLastError () returned 10057 [0082.560] closesocket (s=0x5ac) returned 0 [0082.560] getsockopt (in: s=0x5a8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.560] recv (in: s=0x5a8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.560] WSAGetLastError () returned 10057 [0082.560] closesocket (s=0x5a8) returned 0 [0082.560] getsockopt (in: s=0x5a4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.560] recv (in: s=0x5a4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.560] WSAGetLastError () returned 10057 [0082.560] closesocket (s=0x5a4) returned 0 [0082.560] getsockopt (in: s=0x5a0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.560] recv (in: s=0x5a0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.561] WSAGetLastError () returned 10057 [0082.561] closesocket (s=0x5a0) returned 0 [0082.561] getsockopt (in: s=0x59c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.561] recv (in: s=0x59c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.561] WSAGetLastError () returned 10057 [0082.561] closesocket (s=0x59c) returned 0 [0082.561] getsockopt (in: s=0x598, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.561] recv (in: s=0x598, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.561] WSAGetLastError () returned 10057 [0082.561] closesocket (s=0x598) returned 0 [0082.561] getsockopt (in: s=0x594, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.561] recv (in: s=0x594, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.562] WSAGetLastError () returned 10057 [0082.562] closesocket (s=0x594) returned 0 [0082.562] getsockopt (in: s=0x590, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.562] recv (in: s=0x590, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.562] WSAGetLastError () returned 10057 [0082.562] closesocket (s=0x590) returned 0 [0082.562] getsockopt (in: s=0x58c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.562] recv (in: s=0x58c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.562] WSAGetLastError () returned 10057 [0082.562] closesocket (s=0x58c) returned 0 [0082.562] getsockopt (in: s=0x588, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.562] recv (in: s=0x588, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.562] WSAGetLastError () returned 10057 [0082.562] closesocket (s=0x588) returned 0 [0082.563] getsockopt (in: s=0x584, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.563] recv (in: s=0x584, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.563] WSAGetLastError () returned 10057 [0082.563] closesocket (s=0x584) returned 0 [0082.563] getsockopt (in: s=0x580, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.563] recv (in: s=0x580, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.563] WSAGetLastError () returned 10057 [0082.563] closesocket (s=0x580) returned 0 [0082.563] getsockopt (in: s=0x57c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.563] recv (in: s=0x57c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.563] WSAGetLastError () returned 10057 [0082.563] closesocket (s=0x57c) returned 0 [0082.564] getsockopt (in: s=0x578, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.564] recv (in: s=0x578, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.564] WSAGetLastError () returned 10057 [0082.564] closesocket (s=0x578) returned 0 [0082.565] getsockopt (in: s=0x574, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.565] recv (in: s=0x574, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.565] WSAGetLastError () returned 10057 [0082.565] closesocket (s=0x574) returned 0 [0082.565] getsockopt (in: s=0x570, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.565] recv (in: s=0x570, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.565] WSAGetLastError () returned 10057 [0082.565] closesocket (s=0x570) returned 0 [0082.565] getsockopt (in: s=0x56c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.565] recv (in: s=0x56c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.565] WSAGetLastError () returned 10057 [0082.565] closesocket (s=0x56c) returned 0 [0082.566] getsockopt (in: s=0x568, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.566] recv (in: s=0x568, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.566] WSAGetLastError () returned 10057 [0082.566] closesocket (s=0x568) returned 0 [0082.569] getsockopt (in: s=0x564, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.569] recv (in: s=0x564, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.569] WSAGetLastError () returned 10057 [0082.569] closesocket (s=0x564) returned 0 [0082.570] getsockopt (in: s=0x560, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.570] recv (in: s=0x560, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.570] WSAGetLastError () returned 10057 [0082.570] closesocket (s=0x560) returned 0 [0082.570] getsockopt (in: s=0x55c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.570] recv (in: s=0x55c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.570] WSAGetLastError () returned 10057 [0082.570] closesocket (s=0x55c) returned 0 [0082.570] getsockopt (in: s=0x558, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.570] recv (in: s=0x558, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.570] WSAGetLastError () returned 10057 [0082.570] closesocket (s=0x558) returned 0 [0082.571] getsockopt (in: s=0x554, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.571] recv (in: s=0x554, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.571] WSAGetLastError () returned 10057 [0082.571] closesocket (s=0x554) returned 0 [0082.571] getsockopt (in: s=0x550, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.571] recv (in: s=0x550, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.571] WSAGetLastError () returned 10057 [0082.571] closesocket (s=0x550) returned 0 [0082.571] getsockopt (in: s=0x54c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.571] recv (in: s=0x54c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.571] WSAGetLastError () returned 10057 [0082.571] closesocket (s=0x54c) returned 0 [0082.572] getsockopt (in: s=0x548, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.572] recv (in: s=0x548, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.572] WSAGetLastError () returned 10057 [0082.572] closesocket (s=0x548) returned 0 [0082.572] getsockopt (in: s=0x544, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.572] recv (in: s=0x544, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.572] WSAGetLastError () returned 10057 [0082.572] closesocket (s=0x544) returned 0 [0082.572] getsockopt (in: s=0x540, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.572] recv (in: s=0x540, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.572] WSAGetLastError () returned 10057 [0082.572] closesocket (s=0x540) returned 0 [0082.573] getsockopt (in: s=0x53c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.573] recv (in: s=0x53c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.573] WSAGetLastError () returned 10057 [0082.573] closesocket (s=0x53c) returned 0 [0082.573] getsockopt (in: s=0x538, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.573] recv (in: s=0x538, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.573] WSAGetLastError () returned 10057 [0082.573] closesocket (s=0x538) returned 0 [0082.573] getsockopt (in: s=0x534, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.573] recv (in: s=0x534, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.573] WSAGetLastError () returned 10057 [0082.573] closesocket (s=0x534) returned 0 [0082.574] getsockopt (in: s=0x530, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.574] recv (in: s=0x530, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.574] WSAGetLastError () returned 10057 [0082.574] closesocket (s=0x530) returned 0 [0082.574] getsockopt (in: s=0x52c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.574] recv (in: s=0x52c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.574] WSAGetLastError () returned 10057 [0082.574] closesocket (s=0x52c) returned 0 [0082.574] getsockopt (in: s=0x528, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.574] recv (in: s=0x528, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.574] WSAGetLastError () returned 10057 [0082.574] closesocket (s=0x528) returned 0 [0082.575] getsockopt (in: s=0x524, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.575] recv (in: s=0x524, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.575] WSAGetLastError () returned 10057 [0082.575] closesocket (s=0x524) returned 0 [0082.575] getsockopt (in: s=0x520, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.575] recv (in: s=0x520, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.575] WSAGetLastError () returned 10057 [0082.575] closesocket (s=0x520) returned 0 [0082.575] getsockopt (in: s=0x518, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.575] recv (in: s=0x518, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.575] WSAGetLastError () returned 10057 [0082.575] closesocket (s=0x518) returned 0 [0082.576] getsockopt (in: s=0x514, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.576] recv (in: s=0x514, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.576] WSAGetLastError () returned 10057 [0082.576] closesocket (s=0x514) returned 0 [0082.576] getsockopt (in: s=0x510, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.576] recv (in: s=0x510, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.576] WSAGetLastError () returned 10057 [0082.576] closesocket (s=0x510) returned 0 [0082.576] getsockopt (in: s=0x50c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.576] recv (in: s=0x50c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.576] WSAGetLastError () returned 10057 [0082.576] closesocket (s=0x50c) returned 0 [0082.577] getsockopt (in: s=0x508, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.577] recv (in: s=0x508, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.577] WSAGetLastError () returned 10057 [0082.577] closesocket (s=0x508) returned 0 [0082.577] getsockopt (in: s=0x504, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.577] recv (in: s=0x504, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.577] WSAGetLastError () returned 10057 [0082.577] closesocket (s=0x504) returned 0 [0082.577] getsockopt (in: s=0x500, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.577] recv (in: s=0x500, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.577] WSAGetLastError () returned 10057 [0082.577] closesocket (s=0x500) returned 0 [0082.578] getsockopt (in: s=0x4fc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.578] recv (in: s=0x4fc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.578] WSAGetLastError () returned 10057 [0082.578] closesocket (s=0x4fc) returned 0 [0082.578] getsockopt (in: s=0x4f8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.578] recv (in: s=0x4f8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.578] WSAGetLastError () returned 10057 [0082.578] closesocket (s=0x4f8) returned 0 [0082.578] getsockopt (in: s=0x4f4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.578] recv (in: s=0x4f4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.578] WSAGetLastError () returned 10057 [0082.578] closesocket (s=0x4f4) returned 0 [0082.579] getsockopt (in: s=0x4f0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.579] recv (in: s=0x4f0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.579] WSAGetLastError () returned 10057 [0082.579] closesocket (s=0x4f0) returned 0 [0082.579] getsockopt (in: s=0x4ec, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.579] recv (in: s=0x4ec, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.579] WSAGetLastError () returned 10057 [0082.579] closesocket (s=0x4ec) returned 0 [0082.579] getsockopt (in: s=0x4e8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.579] recv (in: s=0x4e8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.579] WSAGetLastError () returned 10057 [0082.579] closesocket (s=0x4e8) returned 0 [0082.580] getsockopt (in: s=0x4e4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.580] recv (in: s=0x4e4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.580] WSAGetLastError () returned 10057 [0082.580] closesocket (s=0x4e4) returned 0 [0082.580] getsockopt (in: s=0x4e0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.580] recv (in: s=0x4e0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.580] WSAGetLastError () returned 10057 [0082.580] closesocket (s=0x4e0) returned 0 [0082.580] getsockopt (in: s=0x4dc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.580] recv (in: s=0x4dc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.580] WSAGetLastError () returned 10057 [0082.580] closesocket (s=0x4dc) returned 0 [0082.581] getsockopt (in: s=0x4d8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.581] recv (in: s=0x4d8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.581] WSAGetLastError () returned 10057 [0082.581] closesocket (s=0x4d8) returned 0 [0082.581] getsockopt (in: s=0x4d4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.581] recv (in: s=0x4d4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.581] WSAGetLastError () returned 10057 [0082.581] closesocket (s=0x4d4) returned 0 [0082.581] getsockopt (in: s=0x4d0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.581] recv (in: s=0x4d0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.581] WSAGetLastError () returned 10057 [0082.581] closesocket (s=0x4d0) returned 0 [0082.584] getsockopt (in: s=0x4cc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.584] recv (in: s=0x4cc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.584] WSAGetLastError () returned 10057 [0082.584] closesocket (s=0x4cc) returned 0 [0082.584] getsockopt (in: s=0x4c8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.584] recv (in: s=0x4c8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.584] WSAGetLastError () returned 10057 [0082.584] closesocket (s=0x4c8) returned 0 [0082.585] getsockopt (in: s=0x4c4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.585] recv (in: s=0x4c4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.585] WSAGetLastError () returned 10057 [0082.585] closesocket (s=0x4c4) returned 0 [0082.753] getsockopt (in: s=0x4c0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.753] recv (in: s=0x4c0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.753] WSAGetLastError () returned 10057 [0082.753] closesocket (s=0x4c0) returned 0 [0082.753] getsockopt (in: s=0x4bc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.753] recv (in: s=0x4bc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.753] WSAGetLastError () returned 10057 [0082.755] closesocket (s=0x4bc) returned 0 [0082.756] getsockopt (in: s=0x4b8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.756] recv (in: s=0x4b8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.756] WSAGetLastError () returned 10057 [0082.756] closesocket (s=0x4b8) returned 0 [0082.756] getsockopt (in: s=0x4b4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.756] recv (in: s=0x4b4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.756] WSAGetLastError () returned 10057 [0082.756] closesocket (s=0x4b4) returned 0 [0082.756] getsockopt (in: s=0x4b0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.757] recv (in: s=0x4b0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.757] WSAGetLastError () returned 10057 [0082.757] closesocket (s=0x4b0) returned 0 [0082.757] getsockopt (in: s=0x4ac, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.757] recv (in: s=0x4ac, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.757] WSAGetLastError () returned 10057 [0082.757] closesocket (s=0x4ac) returned 0 [0082.757] getsockopt (in: s=0x4a8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.757] recv (in: s=0x4a8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.757] WSAGetLastError () returned 10057 [0082.757] closesocket (s=0x4a8) returned 0 [0082.758] getsockopt (in: s=0x4a4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.758] recv (in: s=0x4a4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.758] WSAGetLastError () returned 10057 [0082.758] closesocket (s=0x4a4) returned 0 [0082.758] getsockopt (in: s=0x4a0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.758] recv (in: s=0x4a0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.758] WSAGetLastError () returned 10057 [0082.758] closesocket (s=0x4a0) returned 0 [0082.758] getsockopt (in: s=0x49c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.758] recv (in: s=0x49c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.758] WSAGetLastError () returned 10057 [0082.758] closesocket (s=0x49c) returned 0 [0082.758] getsockopt (in: s=0x498, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.758] recv (in: s=0x498, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.759] WSAGetLastError () returned 10057 [0082.759] closesocket (s=0x498) returned 0 [0082.759] getsockopt (in: s=0x494, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.759] recv (in: s=0x494, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.759] WSAGetLastError () returned 10057 [0082.759] closesocket (s=0x494) returned 0 [0082.759] getsockopt (in: s=0x490, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.759] recv (in: s=0x490, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.759] WSAGetLastError () returned 10057 [0082.759] closesocket (s=0x490) returned 0 [0082.759] getsockopt (in: s=0x48c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.759] recv (in: s=0x48c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.760] WSAGetLastError () returned 10057 [0082.760] closesocket (s=0x48c) returned 0 [0082.760] getsockopt (in: s=0x488, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.760] recv (in: s=0x488, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.760] WSAGetLastError () returned 10057 [0082.760] closesocket (s=0x488) returned 0 [0082.760] getsockopt (in: s=0x484, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.760] recv (in: s=0x484, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.760] WSAGetLastError () returned 10057 [0082.760] closesocket (s=0x484) returned 0 [0082.760] getsockopt (in: s=0x480, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.760] recv (in: s=0x480, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.760] WSAGetLastError () returned 10057 [0082.761] closesocket (s=0x480) returned 0 [0082.761] getsockopt (in: s=0x47c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.761] recv (in: s=0x47c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.761] WSAGetLastError () returned 10057 [0082.761] closesocket (s=0x47c) returned 0 [0082.761] getsockopt (in: s=0x478, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.761] recv (in: s=0x478, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.761] WSAGetLastError () returned 10057 [0082.761] closesocket (s=0x478) returned 0 [0082.761] getsockopt (in: s=0x474, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.761] recv (in: s=0x474, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.761] WSAGetLastError () returned 10057 [0082.761] closesocket (s=0x474) returned 0 [0082.762] getsockopt (in: s=0x470, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.762] recv (in: s=0x470, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.762] WSAGetLastError () returned 10057 [0082.762] closesocket (s=0x470) returned 0 [0082.762] getsockopt (in: s=0x46c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.762] recv (in: s=0x46c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.762] WSAGetLastError () returned 10057 [0082.762] closesocket (s=0x46c) returned 0 [0082.762] getsockopt (in: s=0x468, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.762] recv (in: s=0x468, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.762] WSAGetLastError () returned 10057 [0082.762] closesocket (s=0x468) returned 0 [0082.763] getsockopt (in: s=0x464, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.763] recv (in: s=0x464, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.763] WSAGetLastError () returned 10057 [0082.763] closesocket (s=0x464) returned 0 [0082.763] getsockopt (in: s=0x3dc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.763] recv (in: s=0x3dc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.763] WSAGetLastError () returned 10057 [0082.763] closesocket (s=0x3dc) returned 0 [0082.763] getsockopt (in: s=0x460, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.763] recv (in: s=0x460, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.763] WSAGetLastError () returned 10057 [0082.763] closesocket (s=0x460) returned 0 [0082.764] getsockopt (in: s=0x45c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.764] recv (in: s=0x45c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.764] WSAGetLastError () returned 10057 [0082.764] closesocket (s=0x45c) returned 0 [0082.764] getsockopt (in: s=0x458, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.764] recv (in: s=0x458, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.764] WSAGetLastError () returned 10057 [0082.764] closesocket (s=0x458) returned 0 [0082.764] getsockopt (in: s=0x454, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.764] recv (in: s=0x454, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.764] WSAGetLastError () returned 10057 [0082.764] closesocket (s=0x454) returned 0 [0082.765] getsockopt (in: s=0x450, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.765] recv (in: s=0x450, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.765] WSAGetLastError () returned 10057 [0082.765] closesocket (s=0x450) returned 0 [0082.765] getsockopt (in: s=0x44c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.765] recv (in: s=0x44c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.765] WSAGetLastError () returned 10057 [0082.765] closesocket (s=0x44c) returned 0 [0082.765] getsockopt (in: s=0x448, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.765] recv (in: s=0x448, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.765] WSAGetLastError () returned 10057 [0082.765] closesocket (s=0x448) returned 0 [0082.766] getsockopt (in: s=0x444, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.766] recv (in: s=0x444, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.766] WSAGetLastError () returned 10057 [0082.766] closesocket (s=0x444) returned 0 [0082.766] getsockopt (in: s=0x440, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.766] recv (in: s=0x440, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.766] WSAGetLastError () returned 10057 [0082.766] closesocket (s=0x440) returned 0 [0082.766] getsockopt (in: s=0x43c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.766] recv (in: s=0x43c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.767] WSAGetLastError () returned 10057 [0082.767] closesocket (s=0x43c) returned 0 [0082.767] getsockopt (in: s=0x438, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.767] recv (in: s=0x438, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.767] WSAGetLastError () returned 10057 [0082.767] closesocket (s=0x438) returned 0 [0082.767] getsockopt (in: s=0x434, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.767] recv (in: s=0x434, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.767] WSAGetLastError () returned 10057 [0082.767] closesocket (s=0x434) returned 0 [0082.768] getsockopt (in: s=0x430, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.768] recv (in: s=0x430, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.768] WSAGetLastError () returned 10057 [0082.768] closesocket (s=0x430) returned 0 [0082.768] getsockopt (in: s=0x42c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.768] recv (in: s=0x42c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.768] WSAGetLastError () returned 10057 [0082.768] closesocket (s=0x42c) returned 0 [0082.768] getsockopt (in: s=0x428, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.768] recv (in: s=0x428, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.768] WSAGetLastError () returned 10057 [0082.768] closesocket (s=0x428) returned 0 [0082.769] getsockopt (in: s=0x424, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.769] recv (in: s=0x424, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.769] WSAGetLastError () returned 10057 [0082.769] closesocket (s=0x424) returned 0 [0082.769] getsockopt (in: s=0x420, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.769] recv (in: s=0x420, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.769] WSAGetLastError () returned 10057 [0082.769] closesocket (s=0x420) returned 0 [0082.769] getsockopt (in: s=0x41c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.769] recv (in: s=0x41c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.769] WSAGetLastError () returned 10057 [0082.769] closesocket (s=0x41c) returned 0 [0082.770] getsockopt (in: s=0x414, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.770] recv (in: s=0x414, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.770] WSAGetLastError () returned 10057 [0082.770] closesocket (s=0x414) returned 0 [0082.770] getsockopt (in: s=0x38c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.770] recv (in: s=0x38c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.770] WSAGetLastError () returned 10057 [0082.770] closesocket (s=0x38c) returned 0 [0082.770] getsockopt (in: s=0x418, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.770] recv (in: s=0x418, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.770] WSAGetLastError () returned 10057 [0082.771] closesocket (s=0x418) returned 0 [0082.771] getsockopt (in: s=0x390, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.771] recv (in: s=0x390, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.771] WSAGetLastError () returned 10057 [0082.771] closesocket (s=0x390) returned 0 [0082.771] getsockopt (in: s=0x410, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.771] recv (in: s=0x410, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.771] WSAGetLastError () returned 10057 [0082.771] closesocket (s=0x410) returned 0 [0082.771] getsockopt (in: s=0x40c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.771] recv (in: s=0x40c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.771] WSAGetLastError () returned 10057 [0082.771] closesocket (s=0x40c) returned 0 [0082.772] getsockopt (in: s=0x408, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.772] recv (in: s=0x408, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.772] WSAGetLastError () returned 10057 [0082.772] closesocket (s=0x408) returned 0 [0082.772] getsockopt (in: s=0x404, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.772] recv (in: s=0x404, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.772] WSAGetLastError () returned 10057 [0082.772] closesocket (s=0x404) returned 0 [0082.772] getsockopt (in: s=0x3fc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.772] recv (in: s=0x3fc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.772] WSAGetLastError () returned 10057 [0082.772] closesocket (s=0x3fc) returned 0 [0082.773] getsockopt (in: s=0x3f8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.773] recv (in: s=0x3f8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.773] WSAGetLastError () returned 10057 [0082.773] closesocket (s=0x3f8) returned 0 [0082.773] getsockopt (in: s=0x3f4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.773] recv (in: s=0x3f4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.773] WSAGetLastError () returned 10057 [0082.773] closesocket (s=0x3f4) returned 0 [0082.773] getsockopt (in: s=0x3f0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.773] recv (in: s=0x3f0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.773] WSAGetLastError () returned 10057 [0082.773] closesocket (s=0x3f0) returned 0 [0082.774] getsockopt (in: s=0x3ec, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.774] recv (in: s=0x3ec, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.774] WSAGetLastError () returned 10057 [0082.774] closesocket (s=0x3ec) returned 0 [0082.774] getsockopt (in: s=0x3e8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.774] recv (in: s=0x3e8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.774] WSAGetLastError () returned 10057 [0082.774] closesocket (s=0x3e8) returned 0 [0082.774] getsockopt (in: s=0x3e4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.774] recv (in: s=0x3e4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.774] WSAGetLastError () returned 10057 [0082.774] closesocket (s=0x3e4) returned 0 [0082.775] getsockopt (in: s=0x3e0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.775] recv (in: s=0x3e0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.775] WSAGetLastError () returned 10057 [0082.775] closesocket (s=0x3e0) returned 0 [0082.775] getsockopt (in: s=0x3cc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.775] recv (in: s=0x3cc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.775] WSAGetLastError () returned 10057 [0082.775] closesocket (s=0x3cc) returned 0 [0082.775] getsockopt (in: s=0x3c8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.775] recv (in: s=0x3c8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.775] WSAGetLastError () returned 10057 [0082.775] closesocket (s=0x3c8) returned 0 [0082.776] getsockopt (in: s=0x3c4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.776] recv (in: s=0x3c4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.776] WSAGetLastError () returned 10057 [0082.776] closesocket (s=0x3c4) returned 0 [0082.776] getsockopt (in: s=0x3c0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.776] recv (in: s=0x3c0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.776] WSAGetLastError () returned 10057 [0082.776] closesocket (s=0x3c0) returned 0 [0082.776] getsockopt (in: s=0x3bc, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.776] recv (in: s=0x3bc, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.776] WSAGetLastError () returned 10057 [0082.776] closesocket (s=0x3bc) returned 0 [0082.777] getsockopt (in: s=0x3b8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.777] recv (in: s=0x3b8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.777] WSAGetLastError () returned 10057 [0082.777] closesocket (s=0x3b8) returned 0 [0082.777] getsockopt (in: s=0x3b4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.777] recv (in: s=0x3b4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.777] WSAGetLastError () returned 10057 [0082.777] closesocket (s=0x3b4) returned 0 [0082.777] getsockopt (in: s=0x3b0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.777] recv (in: s=0x3b0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.777] WSAGetLastError () returned 10057 [0082.777] closesocket (s=0x3b0) returned 0 [0082.778] getsockopt (in: s=0x3ac, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.778] recv (in: s=0x3ac, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.778] WSAGetLastError () returned 10057 [0082.778] closesocket (s=0x3ac) returned 0 [0082.778] getsockopt (in: s=0x3a8, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.778] recv (in: s=0x3a8, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.778] WSAGetLastError () returned 10057 [0082.778] closesocket (s=0x3a8) returned 0 [0082.778] getsockopt (in: s=0x3a4, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.778] recv (in: s=0x3a4, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.778] WSAGetLastError () returned 10057 [0082.778] closesocket (s=0x3a4) returned 0 [0082.779] getsockopt (in: s=0x3a0, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.779] recv (in: s=0x3a0, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.779] WSAGetLastError () returned 10057 [0082.779] closesocket (s=0x3a0) returned 0 [0082.779] getsockopt (in: s=0x39c, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.779] recv (in: s=0x39c, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.779] WSAGetLastError () returned 10057 [0082.779] closesocket (s=0x39c) returned 0 [0082.779] getsockopt (in: s=0x388, level=65535, optname=4103, optval=0x1ecdfed8, optlen=0x1ecdfec4 | out: optval="", optlen=0x1ecdfec4) returned 0 [0082.779] recv (in: s=0x388, buf=0x1ecdfee7, len=1, flags=2 | out: buf=0x1ecdfee7) returned -1 [0082.779] WSAGetLastError () returned 10057 [0082.779] closesocket (s=0x388) returned 0 [0082.780] GetProcessHeap () returned 0x580000 [0082.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb3098 | out: hHeap=0x580000) returned 1 [0082.780] GetProcessHeap () returned 0x580000 [0082.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6752d0 | out: hHeap=0x580000) returned 1 [0082.780] htonl (hostlong=0x100007f) returned 0x7f000001 [0082.780] GetProcessHeap () returned 0x580000 [0082.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64cbc8 | out: hHeap=0x580000) returned 1 [0082.780] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0xffffffff) returned 0x0 [0082.780] GetProcessHeap () returned 0x580000 [0082.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6d58 | out: hHeap=0x580000) returned 1 [0082.780] Sleep (dwMilliseconds=0x2710) [0092.940] CloseHandle (hObject=0x288) returned 1 [0092.940] CloseHandle (hObject=0x284) returned 1 [0092.944] GetProcessHeap () returned 0x580000 [0092.944] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x591480 | out: hHeap=0x580000) returned 1 [0092.945] GetProcessHeap () returned 0x580000 [0092.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad710 | out: hHeap=0x580000) returned 1 [0092.980] GetCurrentThreadId () returned 0xdf4 Thread: id = 13 os_tid = 0xe0c [0061.264] GetCurrentThreadId () returned 0xe0c [0061.273] GetLogicalDrives () returned 0x4 [0061.273] GetProcessHeap () returned 0x580000 [0061.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x591dd8 [0061.277] GetProcessHeap () returned 0x580000 [0061.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x591360 [0061.282] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x28c [0061.282] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x290 [0061.282] GetProcessHeap () returned 0x580000 [0061.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6b00 [0061.286] GetProcessHeap () returned 0x580000 [0061.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6dd0 [0061.291] GetProcessHeap () returned 0x580000 [0061.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6b50 [0061.295] GetProcessHeap () returned 0x580000 [0061.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a7180 [0061.299] GetProcessHeap () returned 0x580000 [0061.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7180 | out: hHeap=0x580000) returned 1 [0061.299] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5a6dd0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.299] GetProcessHeap () returned 0x580000 [0061.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b50 | out: hHeap=0x580000) returned 1 [0061.299] GetProcessHeap () returned 0x580000 [0061.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b00 | out: hHeap=0x580000) returned 1 [0061.299] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ee1ff4c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ee1ff4c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.300] GetProcessHeap () returned 0x580000 [0061.300] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6dd0 | out: hHeap=0x580000) returned 1 [0061.639] GetProcessHeap () returned 0x580000 [0061.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5aba58 [0061.644] GetProcessHeap () returned 0x580000 [0061.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abb48 [0061.649] GetProcessHeap () returned 0x580000 [0061.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5aba70 [0061.757] GetProcessHeap () returned 0x580000 [0061.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0061.871] GetProcessHeap () returned 0x580000 [0061.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abb60 [0061.880] htonl (hostlong=0xb4197730) returned 0x307719b4 [0061.891] QueryPerformanceCounter (in: lpPerformanceCount=0x1ee1fe48 | out: lpPerformanceCount=0x1ee1fe48*=15315704929) returned 1 [0061.891] GetTickCount () returned 0x114fea5 [0061.891] GetCurrentProcessId () returned 0x7fc [0061.891] GetCurrentThreadId () returned 0xe0c [0061.891] GetLocalTime (in: lpSystemTime=0x1ee1fe30 | out: lpSystemTime=0x1ee1fe30*(wYear=0x7e3, wMonth=0xa, wDayOfWeek=0x0, wDay=0xd, wHour=0x9, wMinute=0x2d, wSecond=0x3b, wMilliseconds=0x2c1)) [0061.891] SystemTimeToFileTime (in: lpSystemTime=0x1ee1fe30, lpFileTime=0x1ee1fe40 | out: lpFileTime=0x1ee1fe40) returned 1 [0061.892] QueryPerformanceCounter (in: lpPerformanceCount=0x1ee1fe48 | out: lpPerformanceCount=0x1ee1fe48*=15315731123) returned 1 [0062.002] GetProcessHeap () returned 0x580000 [0062.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x28) returned 0x5c3498 [0062.101] GetProcessHeap () returned 0x580000 [0062.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5aba88 [0062.106] GetProcessHeap () returned 0x580000 [0062.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a6560 [0062.110] GetProcessHeap () returned 0x580000 [0062.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x14) returned 0x590ee8 [0062.115] GetProcessHeap () returned 0x580000 [0062.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abaa0 [0062.120] GetProcessHeap () returned 0x580000 [0062.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80) returned 0x59a860 [0062.125] GetProcessHeap () returned 0x580000 [0062.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abb78 [0062.130] GetProcessHeap () returned 0x580000 [0062.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82) returned 0x5a7788 [0062.207] GetProcessHeap () returned 0x580000 [0062.212] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abb90 [0062.292] GetProcessHeap () returned 0x580000 [0062.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a6600 [0062.307] GetProcessHeap () returned 0x580000 [0062.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abba8 [0062.313] GetProcessHeap () returned 0x580000 [0062.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80) returned 0x5a7180 [0062.318] GetProcessHeap () returned 0x580000 [0062.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abbc0 [0062.417] GetProcessHeap () returned 0x580000 [0062.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2) returned 0x5a65b0 [0062.463] GetProcessHeap () returned 0x580000 [0062.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a6650 [0062.468] GetProcessHeap () returned 0x580000 [0062.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abbd8 [0062.473] GetProcessHeap () returned 0x580000 [0062.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80) returned 0x5c3520 [0062.478] GetProcessHeap () returned 0x580000 [0062.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abc08 [0062.482] GetProcessHeap () returned 0x580000 [0062.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a6680 [0062.487] GetProcessHeap () returned 0x580000 [0062.492] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a65b0, Size=0x82) returned 0x5c35a8 [0062.492] GetProcessHeap () returned 0x580000 [0062.496] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a6680, Size=0x100) returned 0x5c3638 [0062.713] GetProcessHeap () returned 0x580000 [0062.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abd40 [0062.717] GetProcessHeap () returned 0x580000 [0062.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82) returned 0x5c3a10 [0062.722] GetProcessHeap () returned 0x580000 [0062.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abd70 [0062.727] GetProcessHeap () returned 0x580000 [0062.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82) returned 0x5c3aa0 [0062.734] GetProcessHeap () returned 0x580000 [0062.739] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c35a8, Size=0x104) returned 0x5c3b30 [0062.739] GetProcessHeap () returned 0x580000 [0062.744] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c3638, Size=0x200) returned 0x5c4e40 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6650 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c4e40 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abc08 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7180 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abba8 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3520 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abbd8 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3b30 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abbc0 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3a10 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abd40 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3aa0 | out: hHeap=0x580000) returned 1 [0062.745] GetProcessHeap () returned 0x580000 [0062.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abd70 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6560 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aba88 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7788 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abb78 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59a860 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abaa0 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6600 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abb90 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3498 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x590ee8 | out: hHeap=0x580000) returned 1 [0062.746] GetProcessHeap () returned 0x580000 [0062.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa4) returned 0x5c6680 [0062.751] GetProcessHeap () returned 0x580000 [0062.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abb48 | out: hHeap=0x580000) returned 1 [0062.751] GetProcessHeap () returned 0x580000 [0062.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aba70 | out: hHeap=0x580000) returned 1 [0062.751] GetProcessHeap () returned 0x580000 [0062.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0062.751] GetProcessHeap () returned 0x580000 [0062.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abb60 | out: hHeap=0x580000) returned 1 [0062.751] GetProcessHeap () returned 0x580000 [0062.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aba58 | out: hHeap=0x580000) returned 1 [0062.751] GetProcessHeap () returned 0x580000 [0062.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x590ec8 [0062.755] GetProcessHeap () returned 0x580000 [0062.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xe) returned 0x5aba58 [0062.890] ResetEvent (hEvent=0x290) returned 1 [0062.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404a4c, lpParameter=0x590ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0062.897] CloseHandle (hObject=0x2cc) returned 1 [0062.897] GetProcessHeap () returned 0x580000 [0062.902] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abb60 [0062.970] GetProcessHeap () returned 0x580000 [0062.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5aba70 [0062.975] GetProcessHeap () returned 0x580000 [0062.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abb78 [0063.015] GetProcessHeap () returned 0x580000 [0063.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a6f50 [0063.020] GetProcessHeap () returned 0x580000 [0063.025] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abc08 [0063.107] htonl (hostlong=0xb4197730) returned 0x307719b4 [0063.116] GetProcessHeap () returned 0x580000 [0063.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x28) returned 0x5c33d8 [0063.125] GetProcessHeap () returned 0x580000 [0063.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abd88 [0063.130] GetProcessHeap () returned 0x580000 [0063.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a65d0 [0063.135] GetProcessHeap () returned 0x580000 [0063.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x14) returned 0x590e88 [0063.139] GetProcessHeap () returned 0x580000 [0063.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abdd0 [0063.144] GetProcessHeap () returned 0x580000 [0063.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80) returned 0x5c3c40 [0063.149] GetProcessHeap () returned 0x580000 [0063.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x609510 [0063.322] GetProcessHeap () returned 0x580000 [0063.327] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82) returned 0x5a7788 [0063.327] GetProcessHeap () returned 0x580000 [0063.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x609390 [0063.332] GetProcessHeap () returned 0x580000 [0063.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a6550 [0063.346] GetProcessHeap () returned 0x580000 [0063.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x6093a8 [0063.351] GetProcessHeap () returned 0x580000 [0063.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80) returned 0x64bfb8 [0063.513] GetProcessHeap () returned 0x580000 [0063.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x609588 [0063.517] GetProcessHeap () returned 0x580000 [0063.522] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2) returned 0x5a6670 [0063.522] GetProcessHeap () returned 0x580000 [0063.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a66f0 [0063.526] GetProcessHeap () returned 0x580000 [0063.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x6092e8 [0063.531] GetProcessHeap () returned 0x580000 [0063.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80) returned 0x64c040 [0063.535] GetProcessHeap () returned 0x580000 [0063.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x609300 [0063.540] GetProcessHeap () returned 0x580000 [0063.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4) returned 0x5a6680 [0063.545] GetProcessHeap () returned 0x580000 [0063.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a6670, Size=0x82) returned 0x5c7828 [0063.549] GetProcessHeap () returned 0x580000 [0063.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a6680, Size=0x100) returned 0x64c0c8 [0063.554] GetProcessHeap () returned 0x580000 [0063.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x6095a0 [0063.824] GetProcessHeap () returned 0x580000 [0063.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82) returned 0x5c7318 [0063.829] GetProcessHeap () returned 0x580000 [0063.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x609450 [0063.833] GetProcessHeap () returned 0x580000 [0063.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82) returned 0x5c78b8 [0063.839] GetProcessHeap () returned 0x580000 [0063.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5c7828, Size=0x104) returned 0x5c3520 [0063.844] GetProcessHeap () returned 0x580000 [0063.848] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x64c0c8, Size=0x200) returned 0x64c428 [0063.849] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a66f0 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64c428 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x609300 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64bfb8 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6093a8 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64c040 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6092e8 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3520 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x609588 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c7318 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6095a0 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c78b8 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x609450 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a65d0 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abd88 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7788 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x609510 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3c40 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abdd0 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6550 | out: hHeap=0x580000) returned 1 [0063.850] GetProcessHeap () returned 0x580000 [0063.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x609390 | out: hHeap=0x580000) returned 1 [0063.851] GetProcessHeap () returned 0x580000 [0063.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c33d8 | out: hHeap=0x580000) returned 1 [0063.851] GetProcessHeap () returned 0x580000 [0063.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x590e88 | out: hHeap=0x580000) returned 1 [0063.851] GetProcessHeap () returned 0x580000 [0063.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa4) returned 0x5c6cb0 [0063.855] GetProcessHeap () returned 0x580000 [0063.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aba70 | out: hHeap=0x580000) returned 1 [0063.855] GetProcessHeap () returned 0x580000 [0063.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abb78 | out: hHeap=0x580000) returned 1 [0063.856] GetProcessHeap () returned 0x580000 [0063.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6f50 | out: hHeap=0x580000) returned 1 [0063.856] GetProcessHeap () returned 0x580000 [0063.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abc08 | out: hHeap=0x580000) returned 1 [0063.856] GetProcessHeap () returned 0x580000 [0063.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abb60 | out: hHeap=0x580000) returned 1 [0063.856] GetProcessHeap () returned 0x580000 [0063.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x590e28 [0063.860] GetProcessHeap () returned 0x580000 [0063.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0xe) returned 0x609510 [0064.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x404a4c, lpParameter=0x590e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0064.035] CloseHandle (hObject=0x328) returned 1 [0066.670] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) Thread: id = 14 os_tid = 0xf9c [0061.313] GetCurrentThreadId () returned 0xf9c [0061.321] GetLogicalDrives () returned 0x4 [0061.321] GetProcessHeap () returned 0x580000 [0061.326] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20) returned 0x5a6e48 [0061.326] GetProcessHeap () returned 0x580000 [0061.330] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x8, Size=0x1e) returned 0x5a6d80 [0061.330] GetProcessHeap () returned 0x580000 [0061.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5a6b00 [0061.334] GetProcessHeap () returned 0x580000 [0061.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x90) returned 0x5a7180 [0061.339] GetProcessHeap () returned 0x580000 [0061.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a7180 | out: hHeap=0x580000) returned 1 [0061.339] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x5a6d80, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.339] GetProcessHeap () returned 0x580000 [0061.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6b00 | out: hHeap=0x580000) returned 1 [0061.339] GetProcessHeap () returned 0x580000 [0061.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6e48 | out: hHeap=0x580000) returned 1 [0061.339] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ef5ff44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ef5ff44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.339] GetProcessHeap () returned 0x580000 [0061.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a6d80 | out: hHeap=0x580000) returned 1 [0061.339] GetProcessHeap () returned 0x580000 [0061.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40) returned 0x592138 [0061.343] GetProcessHeap () returned 0x580000 [0061.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x591150 [0061.348] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x294 [0061.348] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x298 [0061.559] GetLogicalDrives () returned 0x4 [0061.559] Sleep (dwMilliseconds=0x3e8) [0062.783] GetLogicalDrives () returned 0x4 [0062.783] Sleep (dwMilliseconds=0x3e8) [0063.980] GetLogicalDrives () returned 0x4 [0063.980] Sleep (dwMilliseconds=0x3e8) [0065.228] GetLogicalDrives () returned 0x4 [0065.228] Sleep (dwMilliseconds=0x3e8) [0066.647] GetLogicalDrives () returned 0x4 [0066.647] Sleep (dwMilliseconds=0x3e8) [0068.307] GetLogicalDrives () returned 0x4 [0068.307] Sleep (dwMilliseconds=0x3e8) [0069.581] GetLogicalDrives () returned 0x4 [0069.581] Sleep (dwMilliseconds=0x3e8) [0070.875] GetLogicalDrives () returned 0x4 [0070.875] Sleep (dwMilliseconds=0x3e8) [0072.142] GetLogicalDrives () returned 0x4 [0072.142] Sleep (dwMilliseconds=0x3e8) [0073.809] GetLogicalDrives () returned 0x4 [0073.809] Sleep (dwMilliseconds=0x3e8) [0075.121] GetLogicalDrives () returned 0x4 [0075.121] Sleep (dwMilliseconds=0x3e8) [0076.466] GetLogicalDrives () returned 0x4 [0076.466] Sleep (dwMilliseconds=0x3e8) [0077.980] GetLogicalDrives () returned 0x4 [0077.980] Sleep (dwMilliseconds=0x3e8) [0079.316] GetLogicalDrives () returned 0x4 [0079.316] Sleep (dwMilliseconds=0x3e8) [0080.499] GetLogicalDrives () returned 0x4 [0080.499] Sleep (dwMilliseconds=0x3e8) [0081.622] GetLogicalDrives () returned 0x4 [0081.622] Sleep (dwMilliseconds=0x3e8) [0082.784] GetLogicalDrives () returned 0x4 [0082.784] Sleep (dwMilliseconds=0x3e8) [0083.935] GetLogicalDrives () returned 0x4 [0083.935] Sleep (dwMilliseconds=0x3e8) [0085.144] GetLogicalDrives () returned 0x4 [0085.144] Sleep (dwMilliseconds=0x3e8) [0086.578] GetLogicalDrives () returned 0x4 [0086.582] Sleep (dwMilliseconds=0x3e8) [0087.711] GetLogicalDrives () returned 0x4 [0087.711] Sleep (dwMilliseconds=0x3e8) [0088.834] GetLogicalDrives () returned 0x4 [0088.840] Sleep (dwMilliseconds=0x3e8) [0089.949] GetLogicalDrives () returned 0x4 [0089.949] Sleep (dwMilliseconds=0x3e8) [0091.116] GetLogicalDrives () returned 0x4 [0091.119] Sleep (dwMilliseconds=0x3e8) [0092.212] GetLogicalDrives () returned 0x4 [0092.213] Sleep (dwMilliseconds=0x3e8) [0093.358] GetLogicalDrives () returned 0x4 [0093.358] Sleep (dwMilliseconds=0x3e8) Thread: id = 15 os_tid = 0xe64 [0063.052] GetCurrentThreadId () returned 0xe64 [0063.073] GetProcessHeap () returned 0x580000 [0063.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x38) returned 0x59b3e8 [0063.078] GetProcessHeap () returned 0x580000 [0063.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x590f28 [0063.083] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2f0 [0063.083] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2f4 [0063.083] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2f8 [0063.083] GetProcessHeap () returned 0x580000 [0063.088] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5c89a0 [0063.088] GetProcessHeap () returned 0x580000 [0063.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x5a82a8 [0063.093] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0063.093] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0063.093] Wow64DisableWow64FsRedirection (in: OldValue=0x1f59ff6c | out: OldValue=0x1f59ff6c*=0x0) returned 1 [0063.093] GetProcessHeap () returned 0x580000 [0063.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a82a8 | out: hHeap=0x580000) returned 1 [0063.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x1f59ff70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0063.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x1f59ff70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0063.094] GetProcessHeap () returned 0x580000 [0063.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5d89a8 [0063.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a82b5, dwReserved1=0x75e90100, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x59ada8 [0063.279] GetProcessHeap () returned 0x580000 [0063.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x629f98 [0063.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x59b068 [0063.287] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0063.288] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Logs", cAlternateFileName="")) returned 1 [0063.297] GetProcessHeap () returned 0x580000 [0063.302] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x63afa8 [0063.302] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59b128 [0063.307] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.307] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0063.479] SetEvent (hEvent=0x2f4) returned 1 [0063.479] ResetEvent (hEvent=0x2f8) returned 1 [0063.484] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0063.502] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0063.795] SetEvent (hEvent=0x2f4) returned 1 [0063.796] ResetEvent (hEvent=0x2f8) returned 1 [0063.801] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0063.801] FindClose (in: hFindFile=0x59b128 | out: hFindFile=0x59b128) returned 1 [0063.801] GetProcessHeap () returned 0x580000 [0063.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x63afa8 | out: hHeap=0x580000) returned 1 [0063.801] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0063.812] GetProcessHeap () returned 0x580000 [0063.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x63afa8 [0063.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59b128 [0063.818] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.819] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0063.996] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0064.014] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0064.357] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0064.375] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0064.784] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0064.784] FindClose (in: hFindFile=0x59b128 | out: hFindFile=0x59b128) returned 1 [0064.785] GetProcessHeap () returned 0x580000 [0064.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x63afa8 | out: hHeap=0x580000) returned 1 [0064.786] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0064.786] FindClose (in: hFindFile=0x59b068 | out: hFindFile=0x59b068) returned 1 [0064.786] GetProcessHeap () returned 0x580000 [0064.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x629f98 | out: hHeap=0x580000) returned 1 [0064.786] FindNextFileW (in: hFindFile=0x59ada8, lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a82b5, dwReserved1=0x75e90100, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0065.130] GetProcessHeap () returned 0x580000 [0065.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0065.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c4e8 [0065.135] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0065.136] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0065.145] GetProcessHeap () returned 0x580000 [0065.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0065.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8e8 [0065.150] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.150] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0065.512] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0065.512] FindClose (in: hFindFile=0x64c8e8 | out: hFindFile=0x64c8e8) returned 1 [0065.512] GetProcessHeap () returned 0x580000 [0065.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0065.512] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0065.544] GetProcessHeap () returned 0x580000 [0065.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0065.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0065.550] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.550] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0065.568] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0065.568] FindClose (in: hFindFile=0x64c828 | out: hFindFile=0x64c828) returned 1 [0065.568] GetProcessHeap () returned 0x580000 [0065.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0065.568] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0065.568] FindClose (in: hFindFile=0x64c4e8 | out: hFindFile=0x64c4e8) returned 1 [0065.568] GetProcessHeap () returned 0x580000 [0065.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0065.569] FindNextFileW (in: hFindFile=0x59ada8, lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a82b5, dwReserved1=0x75e90100, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0066.014] FindNextFileW (in: hFindFile=0x59ada8, lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a82b5, dwReserved1=0x75e90100, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0066.023] GetProcessHeap () returned 0x580000 [0066.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0066.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c728 [0066.030] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0066.030] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1025", cAlternateFileName="")) returned 1 [0066.039] GetProcessHeap () returned 0x580000 [0066.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0066.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0066.342] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.343] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0066.625] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0066.877] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0066.957] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0066.957] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0066.965] GetProcessHeap () returned 0x580000 [0066.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0066.965] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1028", cAlternateFileName="")) returned 1 [0066.974] GetProcessHeap () returned 0x580000 [0066.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0066.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0067.021] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.021] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0067.037] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0067.318] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0067.336] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0067.336] FindClose (in: hFindFile=0x64c7a8 | out: hFindFile=0x64c7a8) returned 1 [0067.336] GetProcessHeap () returned 0x580000 [0067.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0067.336] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1029", cAlternateFileName="")) returned 1 [0067.344] GetProcessHeap () returned 0x580000 [0067.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0067.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca68 [0067.410] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.410] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0067.428] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0067.445] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0067.668] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0067.669] FindClose (in: hFindFile=0x64ca68 | out: hFindFile=0x64ca68) returned 1 [0067.669] GetProcessHeap () returned 0x580000 [0067.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0067.669] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1030", cAlternateFileName="")) returned 1 [0067.678] GetProcessHeap () returned 0x580000 [0067.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0067.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0067.684] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.684] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0067.956] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0068.140] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0068.158] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0068.158] FindClose (in: hFindFile=0x64c768 | out: hFindFile=0x64c768) returned 1 [0068.158] GetProcessHeap () returned 0x580000 [0068.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0068.158] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1031", cAlternateFileName="")) returned 1 [0068.307] GetProcessHeap () returned 0x580000 [0068.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0068.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0068.469] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.469] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0068.487] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0068.505] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0068.669] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0068.669] FindClose (in: hFindFile=0x64c6a8 | out: hFindFile=0x64c6a8) returned 1 [0068.669] GetProcessHeap () returned 0x580000 [0068.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0068.669] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1032", cAlternateFileName="")) returned 1 [0068.678] GetProcessHeap () returned 0x580000 [0068.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0068.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0068.684] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.684] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0068.939] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0069.006] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0069.178] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0069.178] FindClose (in: hFindFile=0x64c828 | out: hFindFile=0x64c828) returned 1 [0069.220] GetProcessHeap () returned 0x580000 [0069.221] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0069.221] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1033", cAlternateFileName="")) returned 1 [0069.263] GetProcessHeap () returned 0x580000 [0069.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0069.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0069.283] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.283] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0069.301] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0069.554] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0069.724] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0069.724] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0069.725] GetProcessHeap () returned 0x580000 [0069.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0069.725] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1035", cAlternateFileName="")) returned 1 [0069.734] GetProcessHeap () returned 0x580000 [0069.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0069.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c928 [0069.738] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.738] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0069.756] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0069.982] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0070.000] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0070.000] FindClose (in: hFindFile=0x64c928 | out: hFindFile=0x64c928) returned 1 [0070.000] GetProcessHeap () returned 0x580000 [0070.000] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0070.000] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1036", cAlternateFileName="")) returned 1 [0070.389] GetProcessHeap () returned 0x580000 [0070.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0070.397] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0070.398] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.398] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0070.453] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0070.813] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0070.833] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0070.833] FindClose (in: hFindFile=0x64c428 | out: hFindFile=0x64c428) returned 1 [0070.834] GetProcessHeap () returned 0x580000 [0070.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0071.349] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1037", cAlternateFileName="")) returned 1 [0071.499] GetProcessHeap () returned 0x580000 [0071.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0071.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0071.503] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.503] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0071.522] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0071.807] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0071.825] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0071.825] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0071.825] GetProcessHeap () returned 0x580000 [0071.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0072.382] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1038", cAlternateFileName="")) returned 1 [0072.391] GetProcessHeap () returned 0x580000 [0072.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0072.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4e8 [0072.395] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.395] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.623] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.640] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.640] FindClose (in: hFindFile=0x64c4e8 | out: hFindFile=0x64c4e8) returned 1 [0072.640] GetProcessHeap () returned 0x580000 [0072.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0072.640] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1040", cAlternateFileName="")) returned 1 [0072.649] GetProcessHeap () returned 0x580000 [0072.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0073.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0073.022] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.022] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0073.039] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0073.056] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0073.318] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0073.318] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0073.318] GetProcessHeap () returned 0x580000 [0073.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0073.318] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1041", cAlternateFileName="")) returned 1 [0073.327] GetProcessHeap () returned 0x580000 [0073.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0073.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb68 [0073.332] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.332] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0073.624] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0073.906] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0073.924] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0073.924] FindClose (in: hFindFile=0x64cb68 | out: hFindFile=0x64cb68) returned 1 [0073.924] GetProcessHeap () returned 0x580000 [0073.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0073.924] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1042", cAlternateFileName="")) returned 1 [0073.933] GetProcessHeap () returned 0x580000 [0073.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0074.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8a8 [0074.249] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.250] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0074.268] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0074.445] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0074.464] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0074.464] FindClose (in: hFindFile=0x64c8a8 | out: hFindFile=0x64c8a8) returned 1 [0074.464] GetProcessHeap () returned 0x580000 [0074.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0074.464] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1043", cAlternateFileName="")) returned 1 [0074.474] GetProcessHeap () returned 0x580000 [0074.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0074.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c928 [0074.479] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.479] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0074.646] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0074.664] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0074.926] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0074.928] FindClose (in: hFindFile=0x64c928 | out: hFindFile=0x64c928) returned 1 [0074.929] GetProcessHeap () returned 0x580000 [0074.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0074.929] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1044", cAlternateFileName="")) returned 1 [0074.940] GetProcessHeap () returned 0x580000 [0074.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0074.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0074.978] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.978] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0074.996] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0075.223] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0075.242] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0075.242] FindClose (in: hFindFile=0x64c7a8 | out: hFindFile=0x64c7a8) returned 1 [0075.242] GetProcessHeap () returned 0x580000 [0075.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0075.242] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1045", cAlternateFileName="")) returned 1 [0075.422] GetProcessHeap () returned 0x580000 [0075.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0075.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0075.427] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.427] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0075.478] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0075.495] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0075.948] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0075.948] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0075.948] GetProcessHeap () returned 0x580000 [0075.948] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0075.948] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1046", cAlternateFileName="")) returned 1 [0075.957] GetProcessHeap () returned 0x580000 [0075.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0076.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0076.014] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.014] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0076.226] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0076.425] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0076.443] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0076.443] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0076.443] GetProcessHeap () returned 0x580000 [0076.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0076.443] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1049", cAlternateFileName="")) returned 1 [0076.452] GetProcessHeap () returned 0x580000 [0076.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0076.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0076.457] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.457] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0076.773] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0076.791] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0077.057] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0077.058] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0077.058] GetProcessHeap () returned 0x580000 [0077.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0077.061] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1053", cAlternateFileName="")) returned 1 [0077.110] GetProcessHeap () returned 0x580000 [0077.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0077.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0077.114] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.114] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0077.132] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0077.614] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0077.632] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0077.632] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0077.633] GetProcessHeap () returned 0x580000 [0077.633] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0077.633] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1055", cAlternateFileName="")) returned 1 [0077.982] GetProcessHeap () returned 0x580000 [0077.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0077.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0077.989] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.990] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0078.007] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0078.286] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0078.303] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0078.303] FindClose (in: hFindFile=0x64c768 | out: hFindFile=0x64c768) returned 1 [0078.303] GetProcessHeap () returned 0x580000 [0078.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0078.303] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="2052", cAlternateFileName="")) returned 1 [0078.311] GetProcessHeap () returned 0x580000 [0078.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0078.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb68 [0078.741] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.775] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0078.793] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0078.811] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0079.092] FindNextFileW (in: hFindFile=0x64cb68, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0079.092] FindClose (in: hFindFile=0x64cb68 | out: hFindFile=0x64cb68) returned 1 [0079.097] GetProcessHeap () returned 0x580000 [0079.097] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.097] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="2070", cAlternateFileName="")) returned 1 [0079.097] GetProcessHeap () returned 0x580000 [0079.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.097] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0079.098] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.098] GetProcessHeap () returned 0x580000 [0079.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="3076", cAlternateFileName="")) returned 1 [0079.098] GetProcessHeap () returned 0x580000 [0079.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8a8 [0079.098] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0079.098] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0079.099] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0079.099] FindClose (in: hFindFile=0x64c8a8 | out: hFindFile=0x64c8a8) returned 1 [0079.099] GetProcessHeap () returned 0x580000 [0079.099] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.099] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="3082", cAlternateFileName="")) returned 1 [0079.099] GetProcessHeap () returned 0x580000 [0079.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7e8 [0079.100] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.100] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0079.100] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0079.100] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0079.100] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0079.100] FindClose (in: hFindFile=0x64c7e8 | out: hFindFile=0x64c7e8) returned 1 [0079.100] GetProcessHeap () returned 0x580000 [0079.100] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.100] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Client", cAlternateFileName="")) returned 1 [0079.100] GetProcessHeap () returned 0x580000 [0079.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c968 [0079.100] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.100] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0079.101] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0079.101] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0079.101] FindClose (in: hFindFile=0x64c968 | out: hFindFile=0x64c968) returned 1 [0079.101] GetProcessHeap () returned 0x580000 [0079.101] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.101] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0079.101] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0079.101] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Extended", cAlternateFileName="")) returned 1 [0079.101] GetProcessHeap () returned 0x580000 [0079.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.101] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.101] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0079.103] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0079.103] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0079.103] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0079.103] GetProcessHeap () returned 0x580000 [0079.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.103] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Graphics", cAlternateFileName="")) returned 1 [0079.103] GetProcessHeap () returned 0x580000 [0079.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0079.104] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0079.105] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0079.105] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0079.106] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0079.106] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0079.106] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0079.106] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0079.106] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0079.106] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0079.106] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0079.106] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0079.107] GetProcessHeap () returned 0x580000 [0079.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.107] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0079.107] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0079.107] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0079.107] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0079.107] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0079.107] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0079.108] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0079.108] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0079.108] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0079.111] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0079.111] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0079.111] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0079.112] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0079.112] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0079.112] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0079.112] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0079.112] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0079.112] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0079.116] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0079.120] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0079.120] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0079.121] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0079.121] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0079.121] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0079.121] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0079.121] FindClose (in: hFindFile=0x64c728 | out: hFindFile=0x64c728) returned 1 [0079.121] GetProcessHeap () returned 0x580000 [0079.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.122] FindNextFileW (in: hFindFile=0x59ada8, lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a82b5, dwReserved1=0x75e90100, cFileName="Boot", cAlternateFileName="")) returned 1 [0079.122] GetProcessHeap () returned 0x580000 [0079.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0079.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0079.321] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.321] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD", cAlternateFileName="")) returned 1 [0079.321] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0079.321] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0079.321] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0079.321] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0079.321] GetProcessHeap () returned 0x580000 [0079.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.321] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.321] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.321] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.322] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0079.322] GetProcessHeap () returned 0x580000 [0079.322] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.322] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0079.322] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0079.322] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0079.322] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0079.322] GetProcessHeap () returned 0x580000 [0079.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0079.322] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.322] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.322] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.322] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.323] FindClose (in: hFindFile=0x64c7a8 | out: hFindFile=0x64c7a8) returned 1 [0079.323] GetProcessHeap () returned 0x580000 [0079.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.323] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="da-DK", cAlternateFileName="")) returned 1 [0079.323] GetProcessHeap () returned 0x580000 [0079.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c9a8 [0079.323] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.323] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.323] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.323] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.323] FindClose (in: hFindFile=0x64c9a8 | out: hFindFile=0x64c9a8) returned 1 [0079.323] GetProcessHeap () returned 0x580000 [0079.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.323] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="de-DE", cAlternateFileName="")) returned 1 [0079.323] GetProcessHeap () returned 0x580000 [0079.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c3e8 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.324] FindClose (in: hFindFile=0x64c3e8 | out: hFindFile=0x64c3e8) returned 1 [0079.324] GetProcessHeap () returned 0x580000 [0079.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="el-GR", cAlternateFileName="")) returned 1 [0079.324] GetProcessHeap () returned 0x580000 [0079.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c3e8 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.324] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.324] FindClose (in: hFindFile=0x64c3e8 | out: hFindFile=0x64c3e8) returned 1 [0079.325] GetProcessHeap () returned 0x580000 [0079.325] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="en-GB", cAlternateFileName="")) returned 1 [0079.325] GetProcessHeap () returned 0x580000 [0079.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.325] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.325] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0079.325] GetProcessHeap () returned 0x580000 [0079.325] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.325] GetProcessHeap () returned 0x580000 [0079.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.325] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.325] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.326] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0079.326] GetProcessHeap () returned 0x580000 [0079.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="es-ES", cAlternateFileName="")) returned 1 [0079.326] GetProcessHeap () returned 0x580000 [0079.326] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0079.326] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.326] FindClose (in: hFindFile=0x64c768 | out: hFindFile=0x64c768) returned 1 [0079.326] GetProcessHeap () returned 0x580000 [0079.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.326] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="es-MX", cAlternateFileName="")) returned 1 [0079.327] GetProcessHeap () returned 0x580000 [0079.327] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.327] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.327] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.327] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.327] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0079.327] GetProcessHeap () returned 0x580000 [0079.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.327] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="et-EE", cAlternateFileName="")) returned 1 [0079.327] GetProcessHeap () returned 0x580000 [0079.327] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0079.327] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.327] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.327] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.327] FindClose (in: hFindFile=0x64c7a8 | out: hFindFile=0x64c7a8) returned 1 [0079.328] GetProcessHeap () returned 0x580000 [0079.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.328] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0079.328] GetProcessHeap () returned 0x580000 [0079.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.328] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.328] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.328] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.328] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.328] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.328] GetProcessHeap () returned 0x580000 [0079.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.328] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Fonts", cAlternateFileName="")) returned 1 [0079.328] GetProcessHeap () returned 0x580000 [0079.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.329] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.329] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0079.329] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0079.329] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0079.329] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0079.329] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0079.330] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0079.331] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0079.331] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0079.331] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0079.331] GetProcessHeap () returned 0x580000 [0079.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.331] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0079.331] GetProcessHeap () returned 0x580000 [0079.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0079.332] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.332] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.332] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.332] FindClose (in: hFindFile=0x64c7a8 | out: hFindFile=0x64c7a8) returned 1 [0079.332] GetProcessHeap () returned 0x580000 [0079.332] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.332] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0079.332] GetProcessHeap () returned 0x580000 [0079.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.332] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.332] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.332] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.333] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.333] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.333] GetProcessHeap () returned 0x580000 [0079.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.333] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0079.333] GetProcessHeap () returned 0x580000 [0079.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.333] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.333] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.333] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.333] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0079.333] GetProcessHeap () returned 0x580000 [0079.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.333] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0079.333] GetProcessHeap () returned 0x580000 [0079.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c728 [0079.333] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.333] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.334] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.334] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.334] FindClose (in: hFindFile=0x64c728 | out: hFindFile=0x64c728) returned 1 [0079.334] GetProcessHeap () returned 0x580000 [0079.334] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.334] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="it-IT", cAlternateFileName="")) returned 1 [0079.334] GetProcessHeap () returned 0x580000 [0079.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8e8 [0079.334] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.334] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.334] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.334] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.334] FindClose (in: hFindFile=0x64c8e8 | out: hFindFile=0x64c8e8) returned 1 [0079.334] GetProcessHeap () returned 0x580000 [0079.334] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.334] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0079.335] GetProcessHeap () returned 0x580000 [0079.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0079.335] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.335] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.335] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.335] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.335] FindClose (in: hFindFile=0x64c868 | out: hFindFile=0x64c868) returned 1 [0079.335] GetProcessHeap () returned 0x580000 [0079.335] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.335] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0079.335] GetProcessHeap () returned 0x580000 [0079.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0079.335] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.335] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.335] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.336] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.336] FindClose (in: hFindFile=0x64c6a8 | out: hFindFile=0x64c6a8) returned 1 [0079.336] GetProcessHeap () returned 0x580000 [0079.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.336] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0079.336] GetProcessHeap () returned 0x580000 [0079.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.336] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.336] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.336] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.336] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0079.336] GetProcessHeap () returned 0x580000 [0079.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.336] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0079.336] GetProcessHeap () returned 0x580000 [0079.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.336] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.337] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.337] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.337] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0079.337] GetProcessHeap () returned 0x580000 [0079.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.337] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0079.337] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0079.337] GetProcessHeap () returned 0x580000 [0079.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.338] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.338] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.338] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.338] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.338] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0079.338] GetProcessHeap () returned 0x580000 [0079.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.338] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0079.338] GetProcessHeap () returned 0x580000 [0079.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5e8 [0079.338] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.338] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.338] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.338] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.339] FindClose (in: hFindFile=0x64c5e8 | out: hFindFile=0x64c5e8) returned 1 [0079.339] GetProcessHeap () returned 0x580000 [0079.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.339] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0079.339] GetProcessHeap () returned 0x580000 [0079.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.341] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.341] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.341] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.341] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.341] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.341] GetProcessHeap () returned 0x580000 [0079.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.341] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0079.341] GetProcessHeap () returned 0x580000 [0079.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.342] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.342] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.342] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.343] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.343] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0079.343] GetProcessHeap () returned 0x580000 [0079.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.343] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0079.343] GetProcessHeap () returned 0x580000 [0079.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.343] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.343] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.344] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.344] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.344] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0079.344] GetProcessHeap () returned 0x580000 [0079.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.344] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0079.344] GetProcessHeap () returned 0x580000 [0079.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.344] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.344] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.344] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.344] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.344] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0079.344] GetProcessHeap () returned 0x580000 [0079.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.344] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0079.345] GetProcessHeap () returned 0x580000 [0079.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0079.345] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0079.345] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.345] GetProcessHeap () returned 0x580000 [0079.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.346] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0079.346] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0079.346] GetProcessHeap () returned 0x580000 [0079.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0079.346] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0079.346] GetProcessHeap () returned 0x580000 [0079.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.346] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0079.346] GetProcessHeap () returned 0x580000 [0079.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0079.347] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.347] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.348] FindClose (in: hFindFile=0x64c768 | out: hFindFile=0x64c768) returned 1 [0079.348] GetProcessHeap () returned 0x580000 [0079.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.348] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0079.348] GetProcessHeap () returned 0x580000 [0079.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.348] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.349] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.349] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.349] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.349] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.349] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0079.349] GetProcessHeap () returned 0x580000 [0079.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.349] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0079.349] GetProcessHeap () returned 0x580000 [0079.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.350] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.350] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.353] GetProcessHeap () returned 0x580000 [0079.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.353] GetProcessHeap () returned 0x580000 [0079.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.354] GetProcessHeap () returned 0x580000 [0079.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.354] GetProcessHeap () returned 0x580000 [0079.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.354] GetProcessHeap () returned 0x580000 [0079.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.354] GetProcessHeap () returned 0x580000 [0079.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8e8 [0079.355] GetProcessHeap () returned 0x580000 [0079.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.355] GetProcessHeap () returned 0x580000 [0079.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8a8 [0079.356] GetProcessHeap () returned 0x580000 [0079.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.356] GetProcessHeap () returned 0x580000 [0079.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0079.356] GetProcessHeap () returned 0x580000 [0079.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.356] GetProcessHeap () returned 0x580000 [0079.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.357] GetProcessHeap () returned 0x580000 [0079.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.357] GetProcessHeap () returned 0x580000 [0079.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.357] GetProcessHeap () returned 0x580000 [0079.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.357] GetProcessHeap () returned 0x580000 [0079.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.358] GetProcessHeap () returned 0x580000 [0079.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.358] GetProcessHeap () returned 0x580000 [0079.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0079.358] GetProcessHeap () returned 0x580000 [0079.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.358] GetProcessHeap () returned 0x580000 [0079.359] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0079.359] GetProcessHeap () returned 0x580000 [0079.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0079.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.391] GetProcessHeap () returned 0x580000 [0079.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0079.423] GetProcessHeap () returned 0x580000 [0079.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.428] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0079.429] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0079.430] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0079.431] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0079.432] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0079.433] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0079.434] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0079.435] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0079.436] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0079.437] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0079.438] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0079.439] FindClose (in: hFindFile=0x64c868 | out: hFindFile=0x64c868) returned 1 [0079.440] GetProcessHeap () returned 0x580000 [0079.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.440] FindNextFileW (in: hFindFile=0x59ada8, lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0079.441] FindNextFileW (in: hFindFile=0x59ada8, lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0079.441] GetProcessHeap () returned 0x580000 [0079.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0079.441] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.441] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 0 [0079.441] FindClose (in: hFindFile=0x64c868 | out: hFindFile=0x64c868) returned 1 [0079.441] GetProcessHeap () returned 0x580000 [0079.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0079.441] FindNextFileW (in: hFindFile=0x59ada8, lpFindFileData=0x1f59fce0 | out: lpFindFileData=0x1f59fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2473c9e7, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2473c9e7, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0079.441] GetProcessHeap () returned 0x580000 [0079.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0079.441] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2473c9e7, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2473c9e7, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.442] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2473c9e7, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2473c9e7, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.442] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0079.442] GetProcessHeap () returned 0x580000 [0079.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffb4498 [0079.442] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.442] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.442] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0079.443] GetProcessHeap () returned 0x580000 [0079.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc44a0 [0079.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0079.443] FindNextFileW (in: hFindFile=0x64c5a8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.443] FindNextFileW (in: hFindFile=0x64c5a8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0079.443] FindNextFileW (in: hFindFile=0x64c5a8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0079.443] FindClose (in: hFindFile=0x64c5a8 | out: hFindFile=0x64c5a8) returned 1 [0079.443] GetProcessHeap () returned 0x580000 [0079.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc44a0 | out: hHeap=0x580000) returned 1 [0079.443] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0079.443] GetProcessHeap () returned 0x580000 [0079.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc44a0 [0079.443] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4e8 [0079.444] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.444] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0079.444] GetProcessHeap () returned 0x580000 [0079.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0079.444] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c728 [0079.898] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.898] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0079.898] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0079.898] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0079.898] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0079.898] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0079.898] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0079.899] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0079.900] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0079.901] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0079.903] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0079.904] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0079.905] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0079.905] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0079.905] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0079.905] FindClose (in: hFindFile=0x64c728 | out: hFindFile=0x64c728) returned 1 [0079.905] GetProcessHeap () returned 0x580000 [0079.905] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0079.905] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0079.905] GetProcessHeap () returned 0x580000 [0079.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0079.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0079.906] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.906] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0079.906] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0079.906] GetProcessHeap () returned 0x580000 [0079.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.908] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.908] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.908] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.908] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.908] GetProcessHeap () returned 0x580000 [0079.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.908] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0079.908] GetProcessHeap () returned 0x580000 [0079.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0079.909] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.909] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.909] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.909] FindClose (in: hFindFile=0x64c6a8 | out: hFindFile=0x64c6a8) returned 1 [0079.909] GetProcessHeap () returned 0x580000 [0079.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.909] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0079.909] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0079.909] GetProcessHeap () returned 0x580000 [0079.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.910] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.910] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.910] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.910] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0079.910] GetProcessHeap () returned 0x580000 [0079.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.910] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0079.910] GetProcessHeap () returned 0x580000 [0079.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c528 [0079.910] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.910] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.911] FindClose (in: hFindFile=0x64c528 | out: hFindFile=0x64c528) returned 1 [0079.911] GetProcessHeap () returned 0x580000 [0079.911] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0079.911] GetProcessHeap () returned 0x580000 [0079.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0079.911] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.912] FindClose (in: hFindFile=0x64c428 | out: hFindFile=0x64c428) returned 1 [0079.912] GetProcessHeap () returned 0x580000 [0079.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0079.912] GetProcessHeap () returned 0x580000 [0079.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0079.912] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.912] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0079.912] GetProcessHeap () returned 0x580000 [0079.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0079.912] GetProcessHeap () returned 0x580000 [0079.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c3e8 [0079.913] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.913] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.913] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.913] FindClose (in: hFindFile=0x64c3e8 | out: hFindFile=0x64c3e8) returned 1 [0079.913] GetProcessHeap () returned 0x580000 [0079.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.913] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.913] GetProcessHeap () returned 0x580000 [0079.913] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0079.914] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.914] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0079.914] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0079.914] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0079.915] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.916] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0079.917] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0079.917] FindClose (in: hFindFile=0x64c868 | out: hFindFile=0x64c868) returned 1 [0079.917] GetProcessHeap () returned 0x580000 [0079.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.917] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0079.917] GetProcessHeap () returned 0x580000 [0079.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.918] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.918] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.918] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.918] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0079.918] GetProcessHeap () returned 0x580000 [0079.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.918] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0079.918] GetProcessHeap () returned 0x580000 [0079.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0079.919] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.919] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.919] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.919] FindClose (in: hFindFile=0x64c428 | out: hFindFile=0x64c428) returned 1 [0079.919] GetProcessHeap () returned 0x580000 [0079.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.919] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0079.919] GetProcessHeap () returned 0x580000 [0079.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0079.919] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.919] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.920] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.920] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0079.920] GetProcessHeap () returned 0x580000 [0079.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.920] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0079.920] GetProcessHeap () returned 0x580000 [0079.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c968 [0079.920] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.920] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.920] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.920] FindClose (in: hFindFile=0x64c968 | out: hFindFile=0x64c968) returned 1 [0079.920] GetProcessHeap () returned 0x580000 [0079.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.920] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0079.920] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0079.921] GetProcessHeap () returned 0x580000 [0079.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.921] GetProcessHeap () returned 0x580000 [0079.921] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.921] GetProcessHeap () returned 0x580000 [0079.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c9a8 [0079.922] GetProcessHeap () returned 0x580000 [0079.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.922] GetProcessHeap () returned 0x580000 [0079.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c528 [0079.923] GetProcessHeap () returned 0x580000 [0079.923] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0079.924] GetProcessHeap () returned 0x580000 [0079.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.924] GetProcessHeap () returned 0x580000 [0079.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.924] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c728 [0079.925] GetProcessHeap () returned 0x580000 [0079.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.925] GetProcessHeap () returned 0x580000 [0079.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0079.925] GetProcessHeap () returned 0x580000 [0079.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.925] GetProcessHeap () returned 0x580000 [0079.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6e8 [0079.927] GetProcessHeap () returned 0x580000 [0079.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.928] GetProcessHeap () returned 0x580000 [0079.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5e8 [0079.928] GetProcessHeap () returned 0x580000 [0079.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.928] GetProcessHeap () returned 0x580000 [0079.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0079.929] GetProcessHeap () returned 0x580000 [0079.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.929] GetProcessHeap () returned 0x580000 [0079.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8e8 [0079.929] GetProcessHeap () returned 0x580000 [0079.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.929] GetProcessHeap () returned 0x580000 [0079.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0079.929] GetProcessHeap () returned 0x580000 [0079.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.929] GetProcessHeap () returned 0x580000 [0079.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0079.930] GetProcessHeap () returned 0x580000 [0079.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.930] GetProcessHeap () returned 0x580000 [0079.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff44b8 [0079.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.930] GetProcessHeap () returned 0x580000 [0079.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff44b8 | out: hHeap=0x580000) returned 1 [0079.931] GetProcessHeap () returned 0x580000 [0079.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.931] GetProcessHeap () returned 0x580000 [0079.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0079.932] GetProcessHeap () returned 0x580000 [0079.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.932] GetProcessHeap () returned 0x580000 [0079.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c9a8 [0079.932] GetProcessHeap () returned 0x580000 [0079.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.932] GetProcessHeap () returned 0x580000 [0079.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.933] GetProcessHeap () returned 0x580000 [0079.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.933] GetProcessHeap () returned 0x580000 [0079.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb68 [0079.933] GetProcessHeap () returned 0x580000 [0079.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0079.934] GetProcessHeap () returned 0x580000 [0079.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0079.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5268 [0080.153] GetProcessHeap () returned 0x580000 [0080.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.159] GetProcessHeap () returned 0x580000 [0080.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.166] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.169] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.172] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.174] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.174] GetProcessHeap () returned 0x580000 [0080.174] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.174] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0080.174] GetProcessHeap () returned 0x580000 [0080.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ee8 [0080.175] FindNextFileW (in: hFindFile=0x1fff4ee8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x1fff4ee8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x1fff4ee8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.175] FindClose (in: hFindFile=0x1fff4ee8 | out: hFindFile=0x1fff4ee8) returned 1 [0080.175] GetProcessHeap () returned 0x580000 [0080.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0080.175] GetProcessHeap () returned 0x580000 [0080.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50e8 [0080.176] FindNextFileW (in: hFindFile=0x1fff50e8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x1fff50e8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x1fff50e8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0080.176] FindClose (in: hFindFile=0x1fff50e8 | out: hFindFile=0x1fff50e8) returned 1 [0080.176] GetProcessHeap () returned 0x580000 [0080.176] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0080.176] GetProcessHeap () returned 0x580000 [0080.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50a8 [0080.176] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.176] FindClose (in: hFindFile=0x1fff50a8 | out: hFindFile=0x1fff50a8) returned 1 [0080.176] GetProcessHeap () returned 0x580000 [0080.176] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0080.177] GetProcessHeap () returned 0x580000 [0080.177] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4fa8 [0080.177] FindNextFileW (in: hFindFile=0x1fff4fa8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x1fff4fa8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x1fff4fa8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.177] FindClose (in: hFindFile=0x1fff4fa8 | out: hFindFile=0x1fff4fa8) returned 1 [0080.177] GetProcessHeap () returned 0x580000 [0080.177] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0080.177] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0080.178] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0080.178] GetProcessHeap () returned 0x580000 [0080.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50a8 [0080.178] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.178] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.178] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.178] FindClose (in: hFindFile=0x1fff50a8 | out: hFindFile=0x1fff50a8) returned 1 [0080.178] GetProcessHeap () returned 0x580000 [0080.178] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.178] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0080.178] GetProcessHeap () returned 0x580000 [0080.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.178] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.178] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.178] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.179] FindClose (in: hFindFile=0x1fff4f68 | out: hFindFile=0x1fff4f68) returned 1 [0080.179] GetProcessHeap () returned 0x580000 [0080.179] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.179] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0080.179] GetProcessHeap () returned 0x580000 [0080.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51a8 [0080.179] FindNextFileW (in: hFindFile=0x1fff51a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.179] FindNextFileW (in: hFindFile=0x1fff51a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.179] FindNextFileW (in: hFindFile=0x1fff51a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.179] FindClose (in: hFindFile=0x1fff51a8 | out: hFindFile=0x1fff51a8) returned 1 [0080.179] GetProcessHeap () returned 0x580000 [0080.179] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.179] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0080.179] GetProcessHeap () returned 0x580000 [0080.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.179] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.179] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.180] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.180] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.180] GetProcessHeap () returned 0x580000 [0080.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.180] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0080.180] GetProcessHeap () returned 0x580000 [0080.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5128 [0080.180] FindNextFileW (in: hFindFile=0x1fff5128, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.180] FindNextFileW (in: hFindFile=0x1fff5128, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.180] FindNextFileW (in: hFindFile=0x1fff5128, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.180] FindClose (in: hFindFile=0x1fff5128 | out: hFindFile=0x1fff5128) returned 1 [0080.180] GetProcessHeap () returned 0x580000 [0080.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.180] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0080.180] GetProcessHeap () returned 0x580000 [0080.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.180] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.180] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.181] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.181] GetProcessHeap () returned 0x580000 [0080.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0080.181] GetProcessHeap () returned 0x580000 [0080.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.181] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.181] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.181] GetProcessHeap () returned 0x580000 [0080.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0080.181] GetProcessHeap () returned 0x580000 [0080.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.182] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.182] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.182] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.182] FindClose (in: hFindFile=0x1fff4f68 | out: hFindFile=0x1fff4f68) returned 1 [0080.182] GetProcessHeap () returned 0x580000 [0080.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.182] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0080.182] GetProcessHeap () returned 0x580000 [0080.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52a8 [0080.182] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.182] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.182] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.182] FindClose (in: hFindFile=0x1fff52a8 | out: hFindFile=0x1fff52a8) returned 1 [0080.182] GetProcessHeap () returned 0x580000 [0080.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.182] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.183] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.183] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.183] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.183] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.183] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5168 [0080.183] FindNextFileW (in: hFindFile=0x1fff5168, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.183] FindNextFileW (in: hFindFile=0x1fff5168, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.183] FindNextFileW (in: hFindFile=0x1fff5168, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.183] FindClose (in: hFindFile=0x1fff5168 | out: hFindFile=0x1fff5168) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5f780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0080.184] GetProcessHeap () returned 0x580000 [0080.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.184] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.184] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.184] FindClose (in: hFindFile=0x1fff4f68 | out: hFindFile=0x1fff4f68) returned 1 [0080.184] GetProcessHeap () returned 0x580000 [0080.184] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0080.184] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79680792, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79680792, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x101200, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x9e1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ebfe576, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0080.185] GetProcessHeap () returned 0x580000 [0080.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e68 [0080.185] FindNextFileW (in: hFindFile=0x1fff4e68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x1fff4e68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x1fff4e68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.185] FindClose (in: hFindFile=0x1fff4e68 | out: hFindFile=0x1fff4e68) returned 1 [0080.185] GetProcessHeap () returned 0x580000 [0080.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0080.185] GetProcessHeap () returned 0x580000 [0080.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ce8 [0080.186] FindNextFileW (in: hFindFile=0x1fff4ce8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.186] FindNextFileW (in: hFindFile=0x1fff4ce8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.186] FindNextFileW (in: hFindFile=0x1fff4ce8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.186] FindClose (in: hFindFile=0x1fff4ce8 | out: hFindFile=0x1fff4ce8) returned 1 [0080.186] GetProcessHeap () returned 0x580000 [0080.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.186] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0080.186] GetProcessHeap () returned 0x580000 [0080.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.186] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.186] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.186] FindNextFileW (in: hFindFile=0x1fff4f68, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.186] FindClose (in: hFindFile=0x1fff4f68 | out: hFindFile=0x1fff4f68) returned 1 [0080.186] GetProcessHeap () returned 0x580000 [0080.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.186] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0080.187] GetProcessHeap () returned 0x580000 [0080.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e28 [0080.187] FindNextFileW (in: hFindFile=0x1fff4e28, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.187] FindNextFileW (in: hFindFile=0x1fff4e28, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.187] FindNextFileW (in: hFindFile=0x1fff4e28, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.187] FindClose (in: hFindFile=0x1fff4e28 | out: hFindFile=0x1fff4e28) returned 1 [0080.187] GetProcessHeap () returned 0x580000 [0080.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.187] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0080.187] FindClose (in: hFindFile=0x64c768 | out: hFindFile=0x64c768) returned 1 [0080.187] GetProcessHeap () returned 0x580000 [0080.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.188] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0080.188] GetProcessHeap () returned 0x580000 [0080.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.189] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.189] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0080.189] GetProcessHeap () returned 0x580000 [0080.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.189] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52a8 [0080.189] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.189] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0080.189] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0080.189] FindClose (in: hFindFile=0x1fff52a8 | out: hFindFile=0x1fff52a8) returned 1 [0080.189] GetProcessHeap () returned 0x580000 [0080.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.189] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0080.189] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0080.190] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.190] GetProcessHeap () returned 0x580000 [0080.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.190] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0080.190] GetProcessHeap () returned 0x580000 [0080.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ce8 [0080.191] FindNextFileW (in: hFindFile=0x1fff4ce8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.191] FindNextFileW (in: hFindFile=0x1fff4ce8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0080.191] FindNextFileW (in: hFindFile=0x1fff4ce8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0080.191] GetProcessHeap () returned 0x580000 [0080.191] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.191] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.192] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.192] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x168258, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0080.192] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0080.192] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0080.192] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 0 [0080.192] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.193] GetProcessHeap () returned 0x580000 [0080.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.193] FindNextFileW (in: hFindFile=0x1fff4ce8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0080.193] FindClose (in: hFindFile=0x1fff4ce8 | out: hFindFile=0x1fff4ce8) returned 1 [0080.193] GetProcessHeap () returned 0x580000 [0080.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0080.194] GetProcessHeap () returned 0x580000 [0080.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52a8 [0080.194] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x1fff52a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.194] FindClose (in: hFindFile=0x1fff52a8 | out: hFindFile=0x1fff52a8) returned 1 [0080.194] GetProcessHeap () returned 0x580000 [0080.194] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0080.194] GetProcessHeap () returned 0x580000 [0080.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51a8 [0080.195] FindNextFileW (in: hFindFile=0x1fff51a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x1fff51a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x1fff51a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0080.195] FindClose (in: hFindFile=0x1fff51a8 | out: hFindFile=0x1fff51a8) returned 1 [0080.195] GetProcessHeap () returned 0x580000 [0080.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0080.195] GetProcessHeap () returned 0x580000 [0080.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5268 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x1fff5268, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0080.198] FindClose (in: hFindFile=0x1fff5268 | out: hFindFile=0x1fff5268) returned 1 [0080.199] GetProcessHeap () returned 0x580000 [0080.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.199] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0080.199] GetProcessHeap () returned 0x580000 [0080.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.199] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.199] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0080.199] GetProcessHeap () returned 0x580000 [0080.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4de8 [0080.199] FindNextFileW (in: hFindFile=0x1fff4de8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.199] FindNextFileW (in: hFindFile=0x1fff4de8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.199] FindClose (in: hFindFile=0x1fff4de8 | out: hFindFile=0x1fff4de8) returned 1 [0080.199] GetProcessHeap () returned 0x580000 [0080.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.199] FindNextFileW (in: hFindFile=0x1fff5468, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0080.199] FindClose (in: hFindFile=0x1fff5468 | out: hFindFile=0x1fff5468) returned 1 [0080.199] GetProcessHeap () returned 0x580000 [0080.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.200] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0080.200] GetProcessHeap () returned 0x580000 [0080.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5028 [0080.200] FindNextFileW (in: hFindFile=0x1fff5028, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.201] FindNextFileW (in: hFindFile=0x1fff5028, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0080.201] GetProcessHeap () returned 0x580000 [0080.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50a8 [0080.201] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.201] FindNextFileW (in: hFindFile=0x1fff50a8, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0080.201] FindClose (in: hFindFile=0x1fff50a8 | out: hFindFile=0x1fff50a8) returned 1 [0080.201] GetProcessHeap () returned 0x580000 [0080.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.201] FindNextFileW (in: hFindFile=0x1fff5028, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0080.201] FindClose (in: hFindFile=0x1fff5028 | out: hFindFile=0x1fff5028) returned 1 [0080.201] GetProcessHeap () returned 0x580000 [0080.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.202] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0080.202] GetProcessHeap () returned 0x580000 [0080.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.335] FindNextFileW (in: hFindFile=0x64c5a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x64c5a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x64c5a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x64c5a8, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0080.335] FindClose (in: hFindFile=0x64c5a8 | out: hFindFile=0x64c5a8) returned 1 [0080.335] GetProcessHeap () returned 0x580000 [0080.335] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.335] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0080.336] GetProcessHeap () returned 0x580000 [0080.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c728 [0080.336] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0080.336] FindClose (in: hFindFile=0x64c728 | out: hFindFile=0x64c728) returned 1 [0080.336] GetProcessHeap () returned 0x580000 [0080.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0080.336] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0080.336] GetProcessHeap () returned 0x580000 [0080.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0080.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c728 [0080.337] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.337] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0080.337] GetProcessHeap () returned 0x580000 [0080.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0080.340] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.340] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0080.340] GetProcessHeap () returned 0x580000 [0080.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.342] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0080.342] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0080.342] ResetEvent (hEvent=0x2f0) returned 1 [0080.342] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0080.350] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1f59ed80 | out: lpFindFileData=0x1f59ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0080.350] FindClose (in: hFindFile=0x64c828 | out: hFindFile=0x64c828) returned 1 [0080.350] GetProcessHeap () returned 0x580000 [0080.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.350] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0080.350] ResetEvent (hEvent=0x2f0) returned 1 [0080.350] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0080.557] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0080.557] ResetEvent (hEvent=0x2f0) returned 1 [0080.557] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0080.576] ResetEvent (hEvent=0x2f0) returned 1 [0080.576] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0081.105] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0081.105] ResetEvent (hEvent=0x2f0) returned 1 [0081.105] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0081.262] ResetEvent (hEvent=0x2f0) returned 1 [0081.263] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0081.278] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0081.278] FindClose (in: hFindFile=0x64c868 | out: hFindFile=0x64c868) returned 1 [0081.278] GetProcessHeap () returned 0x580000 [0081.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0081.423] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0081.423] ResetEvent (hEvent=0x2f0) returned 1 [0081.423] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0081.444] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0081.444] ResetEvent (hEvent=0x2f0) returned 1 [0081.444] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0082.635] ResetEvent (hEvent=0x2f0) returned 1 [0082.635] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0082.973] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0082.973] ResetEvent (hEvent=0x2f0) returned 1 [0082.973] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0083.001] FindNextFileW (in: hFindFile=0x64c728, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0083.001] FindClose (in: hFindFile=0x64c728 | out: hFindFile=0x64c728) returned 1 [0083.001] GetProcessHeap () returned 0x580000 [0083.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.001] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 0 [0083.001] FindClose (in: hFindFile=0x64c4e8 | out: hFindFile=0x64c4e8) returned 1 [0083.002] GetProcessHeap () returned 0x580000 [0083.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc44a0 | out: hHeap=0x580000) returned 1 [0083.002] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0083.003] GetProcessHeap () returned 0x580000 [0083.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc44a0 [0083.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0083.003] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.003] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0083.003] ResetEvent (hEvent=0x2f0) returned 1 [0083.003] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0083.592] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0083.592] FindClose (in: hFindFile=0x20029de0 | out: hFindFile=0x20029de0) returned 1 [0083.592] GetProcessHeap () returned 0x580000 [0083.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc44a0 | out: hHeap=0x580000) returned 1 [0083.592] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0083.592] GetProcessHeap () returned 0x580000 [0083.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc44a0 [0083.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0083.592] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.592] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0083.592] GetProcessHeap () returned 0x580000 [0083.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0083.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0083.593] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.593] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0083.593] ResetEvent (hEvent=0x2f0) returned 1 [0083.593] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0083.602] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0083.602] ResetEvent (hEvent=0x2f0) returned 1 [0083.602] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0084.003] ResetEvent (hEvent=0x2f0) returned 1 [0084.003] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0084.479] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0084.479] GetProcessHeap () returned 0x580000 [0084.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0084.480] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.480] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0084.480] ResetEvent (hEvent=0x2f0) returned 1 [0084.480] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0084.551] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0084.551] FindClose (in: hFindFile=0x20029d60 | out: hFindFile=0x20029d60) returned 1 [0084.552] GetProcessHeap () returned 0x580000 [0084.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.552] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0084.552] ResetEvent (hEvent=0x2f0) returned 1 [0084.552] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0084.687] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0084.687] ResetEvent (hEvent=0x2f0) returned 1 [0084.687] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0084.701] ResetEvent (hEvent=0x2f0) returned 1 [0084.701] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0084.711] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0084.711] ResetEvent (hEvent=0x2f0) returned 1 [0084.711] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.137] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0085.137] ResetEvent (hEvent=0x2f0) returned 1 [0085.137] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.333] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0085.333] ResetEvent (hEvent=0x2f0) returned 1 [0085.333] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.355] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0085.355] ResetEvent (hEvent=0x2f0) returned 1 [0085.355] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.562] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0085.562] ResetEvent (hEvent=0x2f0) returned 1 [0085.562] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.753] ResetEvent (hEvent=0x2f0) returned 1 [0085.754] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.785] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0085.785] ResetEvent (hEvent=0x2f0) returned 1 [0085.785] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.792] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0085.793] ResetEvent (hEvent=0x2f0) returned 1 [0085.793] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.825] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0085.825] ResetEvent (hEvent=0x2f0) returned 1 [0085.825] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.840] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0085.840] ResetEvent (hEvent=0x2f0) returned 1 [0085.840] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0085.866] ResetEvent (hEvent=0x2f0) returned 1 [0085.866] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.046] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0086.046] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0086.046] ResetEvent (hEvent=0x2f0) returned 1 [0086.046] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.061] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0086.061] ResetEvent (hEvent=0x2f0) returned 1 [0086.061] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.161] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0086.162] ResetEvent (hEvent=0x2f0) returned 1 [0086.162] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.169] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0086.169] ResetEvent (hEvent=0x2f0) returned 1 [0086.169] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.215] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0086.215] FindClose (in: hFindFile=0x20029f20 | out: hFindFile=0x20029f20) returned 1 [0086.215] GetProcessHeap () returned 0x580000 [0086.215] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0086.215] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0086.215] ResetEvent (hEvent=0x2f0) returned 1 [0086.215] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.233] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0086.233] GetProcessHeap () returned 0x580000 [0086.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0086.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.233] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.233] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0086.234] ResetEvent (hEvent=0x2f0) returned 1 [0086.234] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.239] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0086.239] FindClose (in: hFindFile=0x2002a420 | out: hFindFile=0x2002a420) returned 1 [0086.239] GetProcessHeap () returned 0x580000 [0086.239] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0086.239] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0086.239] GetProcessHeap () returned 0x580000 [0086.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0086.239] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0086.240] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.240] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0086.240] ResetEvent (hEvent=0x2f0) returned 1 [0086.240] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.248] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0086.249] ResetEvent (hEvent=0x2f0) returned 1 [0086.249] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.259] ResetEvent (hEvent=0x2f0) returned 1 [0086.259] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.268] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0086.269] GetProcessHeap () returned 0x580000 [0086.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0086.270] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.270] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0086.270] ResetEvent (hEvent=0x2f0) returned 1 [0086.270] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.295] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0086.295] ResetEvent (hEvent=0x2f0) returned 1 [0086.295] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.317] ResetEvent (hEvent=0x2f0) returned 1 [0086.317] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.336] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0086.336] ResetEvent (hEvent=0x2f0) returned 1 [0086.336] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.343] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0086.344] ResetEvent (hEvent=0x2f0) returned 1 [0086.344] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.635] ResetEvent (hEvent=0x2f0) returned 1 [0086.635] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0086.843] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0086.844] ResetEvent (hEvent=0x2f0) returned 1 [0086.844] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0088.275] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0088.275] FindClose (in: hFindFile=0x2002a3e0 | out: hFindFile=0x2002a3e0) returned 1 [0088.275] GetProcessHeap () returned 0x580000 [0088.275] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0088.277] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0088.277] ResetEvent (hEvent=0x2f0) returned 1 [0088.277] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0088.558] ResetEvent (hEvent=0x2f0) returned 1 [0088.558] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.081] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0090.081] ResetEvent (hEvent=0x2f0) returned 1 [0090.081] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.497] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0090.497] ResetEvent (hEvent=0x2f0) returned 1 [0090.497] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.558] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0090.558] ResetEvent (hEvent=0x2f0) returned 1 [0090.558] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.598] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0090.599] ResetEvent (hEvent=0x2f0) returned 1 [0090.599] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.772] ResetEvent (hEvent=0x2f0) returned 1 [0090.773] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.812] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0090.813] ResetEvent (hEvent=0x2f0) returned 1 [0090.813] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.927] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0090.928] ResetEvent (hEvent=0x2f0) returned 1 [0090.928] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0090.992] ResetEvent (hEvent=0x2f0) returned 1 [0090.992] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.066] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0091.066] ResetEvent (hEvent=0x2f0) returned 1 [0091.066] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.238] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0091.238] ResetEvent (hEvent=0x2f0) returned 1 [0091.238] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.321] ResetEvent (hEvent=0x2f0) returned 1 [0091.321] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.361] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0091.362] ResetEvent (hEvent=0x2f0) returned 1 [0091.362] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.495] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0091.495] ResetEvent (hEvent=0x2f0) returned 1 [0091.495] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.509] ResetEvent (hEvent=0x2f0) returned 1 [0091.509] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.563] FindNextFileW (in: hFindFile=0x20029f20, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0091.563] FindClose (in: hFindFile=0x20029f20 | out: hFindFile=0x20029f20) returned 1 [0091.564] GetProcessHeap () returned 0x580000 [0091.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0091.564] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0091.564] GetProcessHeap () returned 0x580000 [0091.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0091.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0091.565] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.565] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0091.565] GetProcessHeap () returned 0x580000 [0091.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0091.566] FindNextFileW (in: hFindFile=0x2002a4a0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.566] FindNextFileW (in: hFindFile=0x2002a4a0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0091.566] ResetEvent (hEvent=0x2f0) returned 1 [0091.566] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.611] FindNextFileW (in: hFindFile=0x2002a4a0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0091.611] ResetEvent (hEvent=0x2f0) returned 1 [0091.611] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0091.755] FindNextFileW (in: hFindFile=0x2002a4a0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0091.755] ResetEvent (hEvent=0x2f0) returned 1 [0091.755] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.063] ResetEvent (hEvent=0x2f0) returned 1 [0092.063] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.402] FindNextFileW (in: hFindFile=0x2002a4a0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0092.402] ResetEvent (hEvent=0x2f0) returned 1 [0092.402] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.776] FindNextFileW (in: hFindFile=0x2002a4a0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0092.776] FindClose (in: hFindFile=0x2002a4a0 | out: hFindFile=0x2002a4a0) returned 1 [0092.776] GetProcessHeap () returned 0x580000 [0092.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.777] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0092.777] ResetEvent (hEvent=0x2f0) returned 1 [0092.777] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.777] ResetEvent (hEvent=0x2f0) returned 1 [0092.777] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.778] ResetEvent (hEvent=0x2f0) returned 1 [0092.778] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.779] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0092.779] ResetEvent (hEvent=0x2f0) returned 1 [0092.779] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.779] ResetEvent (hEvent=0x2f0) returned 1 [0092.779] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.780] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0092.780] ResetEvent (hEvent=0x2f0) returned 1 [0092.780] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.783] ResetEvent (hEvent=0x2f0) returned 1 [0092.783] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.860] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0092.861] ResetEvent (hEvent=0x2f0) returned 1 [0092.861] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.895] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0092.895] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0092.895] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0092.896] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0092.896] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0092.896] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0092.896] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0092.896] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0092.896] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0092.896] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0092.896] ResetEvent (hEvent=0x2f0) returned 1 [0092.896] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.898] ResetEvent (hEvent=0x2f0) returned 1 [0092.898] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.900] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0092.900] FindClose (in: hFindFile=0x2002a0e0 | out: hFindFile=0x2002a0e0) returned 1 [0092.900] GetProcessHeap () returned 0x580000 [0092.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0092.901] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0092.901] ResetEvent (hEvent=0x2f0) returned 1 [0092.901] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.903] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0092.903] ResetEvent (hEvent=0x2f0) returned 1 [0092.903] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.904] ResetEvent (hEvent=0x2f0) returned 1 [0092.905] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.906] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0092.906] FindClose (in: hFindFile=0x2002a120 | out: hFindFile=0x2002a120) returned 1 [0092.906] GetProcessHeap () returned 0x580000 [0092.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc44a0 | out: hHeap=0x580000) returned 1 [0092.907] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0092.907] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0092.907] GetProcessHeap () returned 0x580000 [0092.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffb4498 | out: hHeap=0x580000) returned 1 [0092.908] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0092.908] ResetEvent (hEvent=0x2f0) returned 1 [0092.908] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.910] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0092.910] GetProcessHeap () returned 0x580000 [0092.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0092.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0092.911] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.911] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.911] GetProcessHeap () returned 0x580000 [0092.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0092.911] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.911] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2dfe94, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x68e10600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0092.911] ResetEvent (hEvent=0x2f0) returned 1 [0092.911] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.913] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3c4cb5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0092.913] ResetEvent (hEvent=0x2f0) returned 1 [0092.913] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.915] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0092.915] ResetEvent (hEvent=0x2f0) returned 1 [0092.915] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.917] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0092.917] FindClose (in: hFindFile=0x20029da0 | out: hFindFile=0x20029da0) returned 1 [0092.917] GetProcessHeap () returned 0x580000 [0092.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.917] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0092.918] ResetEvent (hEvent=0x2f0) returned 1 [0092.918] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.933] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0092.933] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0092.933] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbc534b5e, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0092.933] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0092.933] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4c60b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0092.933] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8ca44c00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc9340, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0092.933] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0092.933] GetProcessHeap () returned 0x580000 [0092.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0092.933] FindNextFileW (in: hFindFile=0x2002a060, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.933] FindNextFileW (in: hFindFile=0x2002a060, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0092.934] FindNextFileW (in: hFindFile=0x2002a060, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0092.934] FindClose (in: hFindFile=0x2002a060 | out: hFindFile=0x2002a060) returned 1 [0092.934] GetProcessHeap () returned 0x580000 [0092.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.934] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0092.934] GetProcessHeap () returned 0x580000 [0092.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.934] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.934] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0092.934] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0092.934] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0092.934] GetProcessHeap () returned 0x580000 [0092.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.934] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0092.934] FindNextFileW (in: hFindFile=0x2002a120, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0092.934] FindClose (in: hFindFile=0x2002a120 | out: hFindFile=0x2002a120) returned 1 [0092.934] GetProcessHeap () returned 0x580000 [0092.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0092.935] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1f59fa50 | out: lpFindFileData=0x1f59fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Java", cAlternateFileName="")) returned 1 [0092.935] GetProcessHeap () returned 0x580000 [0092.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0092.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0092.936] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.936] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1f59f7c0 | out: lpFindFileData=0x1f59f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0092.936] GetProcessHeap () returned 0x580000 [0092.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0092.936] FindNextFileW (in: hFindFile=0x2002a1e0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.936] FindNextFileW (in: hFindFile=0x2002a1e0, lpFindFileData=0x1f59f530 | out: lpFindFileData=0x1f59f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0092.936] GetProcessHeap () returned 0x580000 [0092.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffb40a0 [0092.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.937] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.937] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0092.937] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0092.937] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0092.937] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0092.937] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0092.937] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0092.937] GetProcessHeap () returned 0x580000 [0092.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0092.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0092.938] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.938] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0092.938] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0092.938] ResetEvent (hEvent=0x2f0) returned 1 [0092.938] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.967] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1f59f010 | out: lpFindFileData=0x1f59f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0092.967] FindClose (in: hFindFile=0x20029fe0 | out: hFindFile=0x20029fe0) returned 1 [0092.967] GetProcessHeap () returned 0x580000 [0092.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0092.967] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0092.967] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0092.967] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0092.967] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0092.967] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0092.968] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0092.968] ResetEvent (hEvent=0x2f0) returned 1 [0092.968] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.973] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0092.973] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0092.973] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0092.973] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0092.973] ResetEvent (hEvent=0x2f0) returned 1 [0092.973] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0092.975] ResetEvent (hEvent=0x2f0) returned 1 [0092.975] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.057] ResetEvent (hEvent=0x2f0) returned 1 [0093.057] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.083] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0093.083] ResetEvent (hEvent=0x2f0) returned 1 [0093.083] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.195] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0093.195] ResetEvent (hEvent=0x2f0) returned 1 [0093.195] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.218] ResetEvent (hEvent=0x2f0) returned 1 [0093.218] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.264] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0093.264] ResetEvent (hEvent=0x2f0) returned 1 [0093.264] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.281] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0093.281] ResetEvent (hEvent=0x2f0) returned 1 [0093.281] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.291] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0093.291] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0093.292] ResetEvent (hEvent=0x2f0) returned 1 [0093.292] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.306] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0093.306] ResetEvent (hEvent=0x2f0) returned 1 [0093.306] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.346] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0093.346] ResetEvent (hEvent=0x2f0) returned 1 [0093.346] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.555] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0093.555] ResetEvent (hEvent=0x2f0) returned 1 [0093.555] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.576] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0093.576] ResetEvent (hEvent=0x2f0) returned 1 [0093.576] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.591] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0093.592] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0093.592] ResetEvent (hEvent=0x2f0) returned 1 [0093.592] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.606] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0093.606] ResetEvent (hEvent=0x2f0) returned 1 [0093.606] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.622] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0093.622] ResetEvent (hEvent=0x2f0) returned 1 [0093.622] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.638] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0093.638] ResetEvent (hEvent=0x2f0) returned 1 [0093.638] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.741] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0093.741] ResetEvent (hEvent=0x2f0) returned 1 [0093.741] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) returned 0x0 [0093.990] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1f59f2a0 | out: lpFindFileData=0x1f59f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0093.990] ResetEvent (hEvent=0x2f0) returned 1 [0093.990] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0xffffffff) Thread: id = 16 os_tid = 0x260 [0063.203] GetCurrentThreadId () returned 0x260 [0063.212] GetProcessHeap () returned 0x580000 [0063.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5e9290 [0063.217] GetProcessHeap () returned 0x580000 [0063.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5f9298 [0063.222] GetProcessHeap () returned 0x580000 [0063.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x5c3378 [0063.227] GetProcessHeap () returned 0x580000 [0063.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x110102) returned 0x1f94a020 [0063.406] GetProcessHeap () returned 0x580000 [0063.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x5a8618 [0063.412] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0063.412] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0063.412] Wow64DisableWow64FsRedirection (in: OldValue=0x1f6dff68 | out: OldValue=0x1f6dff68*=0x0) returned 1 [0063.412] GetProcessHeap () returned 0x580000 [0063.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a8618 | out: hHeap=0x580000) returned 1 [0063.423] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0xffffffff) returned 0x0 [0063.432] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0xffffffff) returned 0x0 [0063.442] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0xffffffff) returned 0x0 [0063.739] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0063.740] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=42674) returned 1 [0063.742] CloseHandle (hObject=0x330) returned 1 [0063.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0063.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0063.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0063.743] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0063.743] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0063.743] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0063.743] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x334 [0063.744] ReadFile (in: hFile=0x330, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xa6b2, lpOverlapped=0x0) returned 1 [0063.966] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xa6c0, lpOverlapped=0x0) returned 1 [0063.967] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x122, lpOverlapped=0x0) returned 1 [0063.968] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0063.968] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0063.968] WriteFile (in: hFile=0x330, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xa6b2, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xa6b2, lpOverlapped=0x0) returned 1 [0063.968] FlushFileBuffers (hFile=0x330) returned 1 [0064.666] FlushFileBuffers (hFile=0x334) returned 1 [0064.685] CloseHandle (hObject=0x330) returned 1 [0064.687] CloseHandle (hObject=0x334) returned 1 [0064.688] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0064.967] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0064.973] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=144072) returned 1 [0064.974] CloseHandle (hObject=0x30c) returned 1 [0064.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0064.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0064.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0064.974] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0064.974] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0064.974] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0064.974] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0064.976] ReadFile (in: hFile=0x30c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x232c8, lpOverlapped=0x0) returned 1 [0064.981] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x232d0, lpOverlapped=0x0) returned 1 [0064.985] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0064.985] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0064.985] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0064.986] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x232c8, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x232c8, lpOverlapped=0x0) returned 1 [0064.986] FlushFileBuffers (hFile=0x30c) returned 1 [0065.535] FlushFileBuffers (hFile=0x310) returned 1 [0065.576] CloseHandle (hObject=0x30c) returned 1 [0065.579] CloseHandle (hObject=0x310) returned 1 [0065.582] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0065.612] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0065.766] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=156) returned 1 [0065.766] CloseHandle (hObject=0x30c) returned 1 [0065.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0065.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0065.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0065.767] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0065.767] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0065.767] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0065.767] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0065.767] ReadFile (in: hFile=0x30c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x9c, lpOverlapped=0x0) returned 1 [0065.768] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xa0, lpOverlapped=0x0) returned 1 [0065.769] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0065.769] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0065.769] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0065.769] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x9c, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x9c, lpOverlapped=0x0) returned 1 [0065.769] FlushFileBuffers (hFile=0x30c) returned 1 [0065.785] FlushFileBuffers (hFile=0x33c) returned 1 [0065.797] CloseHandle (hObject=0x30c) returned 1 [0065.797] CloseHandle (hObject=0x33c) returned 1 [0065.798] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0065.826] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.831] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=74) returned 1 [0065.831] CloseHandle (hObject=0x33c) returned 1 [0065.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0065.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0065.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0065.831] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0065.831] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0065.831] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0065.832] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x30c [0065.832] ReadFile (in: hFile=0x33c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4a, lpOverlapped=0x0) returned 1 [0066.142] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x50, lpOverlapped=0x0) returned 1 [0066.143] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0066.143] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0066.144] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0066.144] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4a, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4a, lpOverlapped=0x0) returned 1 [0066.144] FlushFileBuffers (hFile=0x33c) returned 1 [0066.170] FlushFileBuffers (hFile=0x30c) returned 1 [0066.181] CloseHandle (hObject=0x33c) returned 1 [0066.182] CloseHandle (hObject=0x30c) returned 1 [0066.183] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0066.366] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0066.366] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=129) returned 1 [0066.366] CloseHandle (hObject=0x33c) returned 1 [0066.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0066.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0066.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0066.366] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0066.366] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0066.366] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0066.366] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x330 [0066.367] ReadFile (in: hFile=0x33c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x81, lpOverlapped=0x0) returned 1 [0066.368] WriteFile (in: hFile=0x330, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x90, lpOverlapped=0x0) returned 1 [0066.369] WriteFile (in: hFile=0x330, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0066.369] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0066.369] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0066.369] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x81, lpOverlapped=0x0) returned 1 [0066.370] FlushFileBuffers (hFile=0x33c) returned 1 [0066.410] FlushFileBuffers (hFile=0x330) returned 1 [0066.413] CloseHandle (hObject=0x33c) returned 1 [0066.413] CloseHandle (hObject=0x330) returned 1 [0066.414] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0066.684] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0066.684] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=129) returned 1 [0066.684] CloseHandle (hObject=0x330) returned 1 [0066.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0066.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0066.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0066.684] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0066.684] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0066.684] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0066.685] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x33c [0066.685] ReadFile (in: hFile=0x330, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x81, lpOverlapped=0x0) returned 1 [0066.685] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x90, lpOverlapped=0x0) returned 1 [0066.686] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0066.686] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0066.686] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0066.686] WriteFile (in: hFile=0x330, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x81, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x81, lpOverlapped=0x0) returned 1 [0066.687] FlushFileBuffers (hFile=0x330) returned 1 [0066.693] FlushFileBuffers (hFile=0x33c) returned 1 [0066.695] CloseHandle (hObject=0x330) returned 1 [0066.695] CloseHandle (hObject=0x33c) returned 1 [0066.696] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0066.991] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0066.994] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=0) returned 1 [0066.994] CloseHandle (hObject=0x338) returned 1 [0067.020] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0067.049] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=74214) returned 1 [0067.051] CloseHandle (hObject=0x310) returned 1 [0067.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0067.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0067.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0067.054] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0067.054] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0067.054] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0067.054] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0067.056] ReadFile (in: hFile=0x310, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x121e6, lpOverlapped=0x0) returned 1 [0067.092] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x121f0, lpOverlapped=0x0) returned 1 [0067.093] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0067.094] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0067.094] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0067.094] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x121e6, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x121e6, lpOverlapped=0x0) returned 1 [0067.094] FlushFileBuffers (hFile=0x310) returned 1 [0067.610] FlushFileBuffers (hFile=0x33c) returned 1 [0067.611] CloseHandle (hObject=0x310) returned 1 [0067.613] CloseHandle (hObject=0x33c) returned 1 [0067.614] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0067.642] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0067.884] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=60816) returned 1 [0067.884] CloseHandle (hObject=0x33c) returned 1 [0067.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0067.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0067.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0067.885] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0067.885] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0067.885] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0067.885] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0067.885] ReadFile (in: hFile=0x33c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xed90, lpOverlapped=0x0) returned 1 [0067.888] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xeda0, lpOverlapped=0x0) returned 1 [0067.889] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0067.889] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0067.889] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0067.890] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xed90, lpOverlapped=0x0) returned 1 [0067.890] FlushFileBuffers (hFile=0x33c) returned 1 [0068.279] FlushFileBuffers (hFile=0x310) returned 1 [0068.281] CloseHandle (hObject=0x33c) returned 1 [0068.282] CloseHandle (hObject=0x310) returned 1 [0068.284] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0068.431] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0068.432] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=3726) returned 1 [0068.432] CloseHandle (hObject=0x360) returned 1 [0068.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0068.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0068.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0068.433] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0068.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0068.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0068.433] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0068.435] ReadFile (in: hFile=0x360, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xe8e, lpOverlapped=0x0) returned 1 [0068.653] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xe90, lpOverlapped=0x0) returned 1 [0068.654] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0068.654] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0068.654] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0068.654] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xe8e, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xe8e, lpOverlapped=0x0) returned 1 [0068.654] FlushFileBuffers (hFile=0x360) returned 1 [0069.154] FlushFileBuffers (hFile=0x310) returned 1 [0069.155] CloseHandle (hObject=0x360) returned 1 [0069.156] CloseHandle (hObject=0x310) returned 1 [0069.156] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0069.324] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0069.324] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18264) returned 1 [0069.324] CloseHandle (hObject=0x360) returned 1 [0069.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0069.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0069.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0069.325] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0069.325] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0069.325] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0069.325] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0069.325] ReadFile (in: hFile=0x360, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4758, lpOverlapped=0x0) returned 1 [0069.327] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4760, lpOverlapped=0x0) returned 1 [0069.328] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0069.329] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0069.329] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0069.329] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4758, lpOverlapped=0x0) returned 1 [0069.329] FlushFileBuffers (hFile=0x360) returned 1 [0069.772] FlushFileBuffers (hFile=0x334) returned 1 [0069.781] CloseHandle (hObject=0x360) returned 1 [0069.783] CloseHandle (hObject=0x334) returned 1 [0069.784] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0069.811] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.816] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18264) returned 1 [0069.816] CloseHandle (hObject=0x334) returned 1 [0069.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0069.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0069.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0069.816] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0069.816] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0069.816] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0069.816] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x360 [0069.816] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4758, lpOverlapped=0x0) returned 1 [0069.818] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4760, lpOverlapped=0x0) returned 1 [0069.819] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0069.819] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0069.819] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0069.819] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4758, lpOverlapped=0x0) returned 1 [0069.819] FlushFileBuffers (hFile=0x334) returned 1 [0070.485] FlushFileBuffers (hFile=0x360) returned 1 [0070.496] CloseHandle (hObject=0x334) returned 1 [0070.497] CloseHandle (hObject=0x360) returned 1 [0070.498] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0070.762] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0070.798] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=8876) returned 1 [0070.798] CloseHandle (hObject=0x30c) returned 1 [0070.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0070.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0070.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0070.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0070.799] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0070.799] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0070.799] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0070.805] ReadFile (in: hFile=0x30c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x22ac, lpOverlapped=0x0) returned 1 [0070.811] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x22b0, lpOverlapped=0x0) returned 1 [0070.812] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0070.812] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0070.813] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0070.813] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x22ac, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x22ac, lpOverlapped=0x0) returned 1 [0070.813] FlushFileBuffers (hFile=0x30c) returned 1 [0070.828] FlushFileBuffers (hFile=0x368) returned 1 [0070.834] CloseHandle (hObject=0x30c) returned 1 [0070.835] CloseHandle (hObject=0x368) returned 1 [0070.835] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0070.864] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0070.864] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=86284) returned 1 [0070.864] CloseHandle (hObject=0x368) returned 1 [0070.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0070.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0070.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0070.864] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0070.864] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0070.864] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0070.864] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0070.865] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x1510c, lpOverlapped=0x0) returned 1 [0070.995] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x15110, lpOverlapped=0x0) returned 1 [0070.997] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0070.998] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0070.998] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0070.998] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x1510c, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x1510c, lpOverlapped=0x0) returned 1 [0070.998] FlushFileBuffers (hFile=0x368) returned 1 [0071.456] FlushFileBuffers (hFile=0x30c) returned 1 [0071.457] CloseHandle (hObject=0x368) returned 1 [0071.459] CloseHandle (hObject=0x30c) returned 1 [0071.462] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0071.666] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0071.666] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=3188) returned 1 [0071.666] CloseHandle (hObject=0x334) returned 1 [0071.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0071.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0071.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0071.666] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0071.666] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0071.666] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0071.666] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x360 [0071.696] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xc74, lpOverlapped=0x0) returned 1 [0071.713] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xc80, lpOverlapped=0x0) returned 1 [0071.714] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0071.714] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0071.714] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0071.714] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc74, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xc74, lpOverlapped=0x0) returned 1 [0071.714] FlushFileBuffers (hFile=0x334) returned 1 [0071.725] FlushFileBuffers (hFile=0x360) returned 1 [0071.763] CloseHandle (hObject=0x334) returned 1 [0071.764] CloseHandle (hObject=0x360) returned 1 [0071.765] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0071.793] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0071.793] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=17240) returned 1 [0071.793] CloseHandle (hObject=0x360) returned 1 [0071.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0071.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0071.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0071.793] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0071.793] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0071.793] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0071.793] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0071.794] ReadFile (in: hFile=0x360, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4358, lpOverlapped=0x0) returned 1 [0071.795] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4360, lpOverlapped=0x0) returned 1 [0071.797] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0071.797] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0071.797] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0071.797] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4358, lpOverlapped=0x0) returned 1 [0071.797] FlushFileBuffers (hFile=0x360) returned 1 [0072.669] FlushFileBuffers (hFile=0x334) returned 1 [0072.674] CloseHandle (hObject=0x360) returned 1 [0072.675] CloseHandle (hObject=0x334) returned 1 [0072.676] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0072.704] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0072.705] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=77022) returned 1 [0072.705] CloseHandle (hObject=0x334) returned 1 [0072.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0072.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0072.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0072.705] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0072.705] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0072.705] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0072.705] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x360 [0072.706] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x12cde, lpOverlapped=0x0) returned 1 [0072.841] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x12ce0, lpOverlapped=0x0) returned 1 [0072.843] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0072.843] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0072.843] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0072.843] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x12cde, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x12cde, lpOverlapped=0x0) returned 1 [0072.844] FlushFileBuffers (hFile=0x334) returned 1 [0073.253] FlushFileBuffers (hFile=0x360) returned 1 [0073.254] CloseHandle (hObject=0x334) returned 1 [0073.256] CloseHandle (hObject=0x360) returned 1 [0073.258] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0073.285] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0073.285] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18776) returned 1 [0073.285] CloseHandle (hObject=0x360) returned 1 [0073.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0073.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0073.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0073.286] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0073.286] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0073.286] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0073.286] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0073.286] ReadFile (in: hFile=0x360, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4958, lpOverlapped=0x0) returned 1 [0073.504] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4960, lpOverlapped=0x0) returned 1 [0073.529] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0073.529] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0073.529] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0073.529] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4958, lpOverlapped=0x0) returned 1 [0073.529] FlushFileBuffers (hFile=0x360) returned 1 [0074.007] FlushFileBuffers (hFile=0x334) returned 1 [0074.010] CloseHandle (hObject=0x360) returned 1 [0074.011] CloseHandle (hObject=0x334) returned 1 [0074.012] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0074.042] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0074.043] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=16728) returned 1 [0074.043] CloseHandle (hObject=0x334) returned 1 [0074.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0074.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0074.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0074.043] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0074.043] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0074.043] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0074.043] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x360 [0074.044] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4158, lpOverlapped=0x0) returned 1 [0074.162] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4160, lpOverlapped=0x0) returned 1 [0074.163] WriteFile (in: hFile=0x360, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0074.163] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0074.164] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0074.164] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4158, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4158, lpOverlapped=0x0) returned 1 [0074.164] FlushFileBuffers (hFile=0x334) returned 1 [0074.596] FlushFileBuffers (hFile=0x360) returned 1 [0074.598] CloseHandle (hObject=0x334) returned 1 [0074.599] CloseHandle (hObject=0x360) returned 1 [0074.600] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0074.630] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0074.757] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18776) returned 1 [0074.757] CloseHandle (hObject=0x30c) returned 1 [0074.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0074.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0074.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0074.757] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0074.757] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0074.757] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0074.757] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0074.758] ReadFile (in: hFile=0x30c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4958, lpOverlapped=0x0) returned 1 [0074.759] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4960, lpOverlapped=0x0) returned 1 [0074.760] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0074.761] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0074.761] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0074.761] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4958, lpOverlapped=0x0) returned 1 [0074.761] FlushFileBuffers (hFile=0x30c) returned 1 [0075.389] FlushFileBuffers (hFile=0x368) returned 1 [0075.427] CloseHandle (hObject=0x30c) returned 1 [0075.428] CloseHandle (hObject=0x368) returned 1 [0075.429] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0075.457] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.458] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18264) returned 1 [0075.458] CloseHandle (hObject=0x368) returned 1 [0075.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0075.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0075.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0075.458] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.458] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0075.458] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0075.459] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0075.459] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4758, lpOverlapped=0x0) returned 1 [0075.931] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4760, lpOverlapped=0x0) returned 1 [0075.932] WriteFile (in: hFile=0x30c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0075.933] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0075.933] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0075.933] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4758, lpOverlapped=0x0) returned 1 [0075.933] FlushFileBuffers (hFile=0x368) returned 1 [0076.091] FlushFileBuffers (hFile=0x30c) returned 1 [0076.092] CloseHandle (hObject=0x368) returned 1 [0076.093] CloseHandle (hObject=0x30c) returned 1 [0076.094] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0076.160] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.160] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=68226) returned 1 [0076.160] CloseHandle (hObject=0x368) returned 1 [0076.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0076.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0076.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0076.160] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.160] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0076.161] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0076.161] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0076.161] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x10a82, lpOverlapped=0x0) returned 1 [0076.214] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x10a90, lpOverlapped=0x0) returned 1 [0076.215] WriteFile (in: hFile=0x33c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0076.215] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0076.215] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0076.216] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x10a82, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x10a82, lpOverlapped=0x0) returned 1 [0076.216] FlushFileBuffers (hFile=0x368) returned 1 [0076.231] FlushFileBuffers (hFile=0x33c) returned 1 [0076.281] CloseHandle (hObject=0x368) returned 1 [0076.283] CloseHandle (hObject=0x33c) returned 1 [0076.285] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0076.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0076.493] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=15704) returned 1 [0076.493] CloseHandle (hObject=0x310) returned 1 [0076.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0076.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0076.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0076.494] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0076.494] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0076.494] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0076.494] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0076.494] ReadFile (in: hFile=0x310, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x3d58, lpOverlapped=0x0) returned 1 [0076.497] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x3d60, lpOverlapped=0x0) returned 1 [0076.498] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0076.498] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0076.499] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0076.499] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x3d58, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x3d58, lpOverlapped=0x0) returned 1 [0076.499] FlushFileBuffers (hFile=0x310) returned 1 [0077.058] FlushFileBuffers (hFile=0x334) returned 1 [0077.061] CloseHandle (hObject=0x310) returned 1 [0077.062] CloseHandle (hObject=0x334) returned 1 [0077.063] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0077.101] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0077.101] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=15192) returned 1 [0077.101] CloseHandle (hObject=0x334) returned 1 [0077.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0077.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0077.101] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0077.101] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0077.102] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0077.102] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0077.102] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0077.102] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x3b58, lpOverlapped=0x0) returned 1 [0077.530] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x3b60, lpOverlapped=0x0) returned 1 [0077.586] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0077.586] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0077.586] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0077.586] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x3b58, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x3b58, lpOverlapped=0x0) returned 1 [0077.586] FlushFileBuffers (hFile=0x334) returned 1 [0077.873] FlushFileBuffers (hFile=0x310) returned 1 [0077.910] CloseHandle (hObject=0x334) returned 1 [0077.911] CloseHandle (hObject=0x310) returned 1 [0077.912] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0077.939] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0077.939] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=79634) returned 1 [0077.939] CloseHandle (hObject=0x310) returned 1 [0077.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0077.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0077.939] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0077.939] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0077.939] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0077.939] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0077.939] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0077.939] ReadFile (in: hFile=0x310, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x13712, lpOverlapped=0x0) returned 1 [0077.942] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x13720, lpOverlapped=0x0) returned 1 [0077.944] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0077.944] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0077.944] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0077.944] WriteFile (in: hFile=0x310, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x13712, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x13712, lpOverlapped=0x0) returned 1 [0077.945] FlushFileBuffers (hFile=0x310) returned 1 [0078.740] FlushFileBuffers (hFile=0x334) returned 1 [0078.741] CloseHandle (hObject=0x310) returned 1 [0078.743] CloseHandle (hObject=0x334) returned 1 [0078.745] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0078.774] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0078.774] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=3046) returned 1 [0078.774] CloseHandle (hObject=0x334) returned 1 [0078.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0078.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0078.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0078.774] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0078.774] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0078.775] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0078.775] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0079.081] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xbe6, lpOverlapped=0x0) returned 1 [0079.083] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xbf0, lpOverlapped=0x0) returned 1 [0079.084] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0079.084] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0079.084] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0079.084] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xbe6, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xbe6, lpOverlapped=0x0) returned 1 [0079.084] FlushFileBuffers (hFile=0x334) returned 1 [0079.087] FlushFileBuffers (hFile=0x368) returned 1 [0079.088] CloseHandle (hObject=0x334) returned 1 [0079.089] CloseHandle (hObject=0x368) returned 1 [0079.089] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0079.090] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0079.091] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=17752) returned 1 [0079.091] CloseHandle (hObject=0x368) returned 1 [0079.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0079.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0079.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.091] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0079.091] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0079.091] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0079.091] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0079.091] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4558, lpOverlapped=0x0) returned 1 [0079.093] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4560, lpOverlapped=0x0) returned 1 [0079.095] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0079.095] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0079.095] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0079.095] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4558, lpOverlapped=0x0) returned 1 [0079.095] FlushFileBuffers (hFile=0x368) returned 1 [0079.854] FlushFileBuffers (hFile=0x334) returned 1 [0079.855] CloseHandle (hObject=0x368) returned 1 [0079.856] CloseHandle (hObject=0x334) returned 1 [0079.857] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0079.859] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0079.859] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18264) returned 1 [0079.859] CloseHandle (hObject=0x334) returned 1 [0079.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0079.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0079.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.859] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0079.859] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0079.859] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0079.859] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0079.860] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4758, lpOverlapped=0x0) returned 1 [0079.861] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4760, lpOverlapped=0x0) returned 1 [0079.863] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0079.863] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0079.863] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0079.863] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4758, lpOverlapped=0x0) returned 1 [0079.864] FlushFileBuffers (hFile=0x334) returned 1 [0080.340] FlushFileBuffers (hFile=0x368) returned 1 [0080.344] CloseHandle (hObject=0x334) returned 1 [0080.345] CloseHandle (hObject=0x368) returned 1 [0080.346] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0080.347] SetEvent (hEvent=0x2f0) returned 1 [0080.347] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0080.348] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18264) returned 1 [0080.348] CloseHandle (hObject=0x368) returned 1 [0080.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0080.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0080.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0080.348] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0080.348] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0080.348] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0080.348] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0080.349] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4758, lpOverlapped=0x0) returned 1 [0080.351] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4760, lpOverlapped=0x0) returned 1 [0080.352] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0080.352] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0080.352] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0080.352] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4758, lpOverlapped=0x0) returned 1 [0080.352] FlushFileBuffers (hFile=0x368) returned 1 [0081.094] FlushFileBuffers (hFile=0x334) returned 1 [0081.095] CloseHandle (hObject=0x368) returned 1 [0081.096] CloseHandle (hObject=0x334) returned 1 [0081.097] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0081.100] SetEvent (hEvent=0x2f0) returned 1 [0081.100] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0081.100] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18264) returned 1 [0081.100] CloseHandle (hObject=0x334) returned 1 [0081.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0081.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0081.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0081.103] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0081.103] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0081.103] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0081.103] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0081.103] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4758, lpOverlapped=0x0) returned 1 [0081.105] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4760, lpOverlapped=0x0) returned 1 [0081.107] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0081.107] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0081.107] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0081.107] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4758, lpOverlapped=0x0) returned 1 [0081.107] FlushFileBuffers (hFile=0x334) returned 1 [0081.435] FlushFileBuffers (hFile=0x368) returned 1 [0081.436] CloseHandle (hObject=0x334) returned 1 [0081.437] CloseHandle (hObject=0x368) returned 1 [0081.438] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0081.442] SetEvent (hEvent=0x2f0) returned 1 [0081.442] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0081.442] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=17752) returned 1 [0081.442] CloseHandle (hObject=0x368) returned 1 [0081.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0081.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0081.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0081.442] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0081.443] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0081.443] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0081.443] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0081.443] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4558, lpOverlapped=0x0) returned 1 [0081.445] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4560, lpOverlapped=0x0) returned 1 [0081.446] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0081.446] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0081.446] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0081.446] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4558, lpOverlapped=0x0) returned 1 [0081.446] FlushFileBuffers (hFile=0x368) returned 1 [0082.979] FlushFileBuffers (hFile=0x334) returned 1 [0082.994] CloseHandle (hObject=0x368) returned 1 [0082.995] CloseHandle (hObject=0x334) returned 1 [0082.996] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0082.997] SetEvent (hEvent=0x2f0) returned 1 [0082.997] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0082.997] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=17752) returned 1 [0082.997] CloseHandle (hObject=0x334) returned 1 [0082.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0082.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0082.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0082.997] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0082.997] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0082.997] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0082.997] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0082.998] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4558, lpOverlapped=0x0) returned 1 [0083.004] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4560, lpOverlapped=0x0) returned 1 [0083.005] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0083.005] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0083.005] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0083.005] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4558, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4558, lpOverlapped=0x0) returned 1 [0083.006] FlushFileBuffers (hFile=0x334) returned 1 [0083.571] FlushFileBuffers (hFile=0x368) returned 1 [0083.595] CloseHandle (hObject=0x334) returned 1 [0083.595] CloseHandle (hObject=0x368) returned 1 [0083.596] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0083.597] SetEvent (hEvent=0x2f0) returned 1 [0083.597] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0083.598] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=60684) returned 1 [0083.598] CloseHandle (hObject=0x368) returned 1 [0083.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0083.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0083.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0083.598] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0083.598] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0083.598] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0083.598] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0083.598] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xed0c, lpOverlapped=0x0) returned 1 [0083.603] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xed10, lpOverlapped=0x0) returned 1 [0083.605] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0083.605] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0083.605] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0083.605] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xed0c, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xed0c, lpOverlapped=0x0) returned 1 [0083.605] FlushFileBuffers (hFile=0x368) returned 1 [0084.181] FlushFileBuffers (hFile=0x334) returned 1 [0084.677] CloseHandle (hObject=0x368) returned 1 [0084.679] CloseHandle (hObject=0x334) returned 1 [0084.681] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0084.682] SetEvent (hEvent=0x2f0) returned 1 [0084.682] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0084.685] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=18776) returned 1 [0084.685] CloseHandle (hObject=0x334) returned 1 [0084.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0084.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0084.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0084.685] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0084.685] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0084.685] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0084.685] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0084.686] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x4958, lpOverlapped=0x0) returned 1 [0084.687] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x4960, lpOverlapped=0x0) returned 1 [0084.688] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0084.688] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0084.689] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0084.689] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x4958, lpOverlapped=0x0) returned 1 [0084.689] FlushFileBuffers (hFile=0x334) returned 1 [0084.703] FlushFileBuffers (hFile=0x368) returned 1 [0084.707] CloseHandle (hObject=0x334) returned 1 [0084.707] CloseHandle (hObject=0x368) returned 1 [0084.708] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0084.709] SetEvent (hEvent=0x2f0) returned 1 [0084.709] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0084.709] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=60816) returned 1 [0084.709] CloseHandle (hObject=0x368) returned 1 [0084.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0084.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0084.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0084.710] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0084.710] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0084.710] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0084.710] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0084.710] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xed90, lpOverlapped=0x0) returned 1 [0084.712] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xeda0, lpOverlapped=0x0) returned 1 [0084.714] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0084.714] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0084.714] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0084.714] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xed90, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xed90, lpOverlapped=0x0) returned 1 [0084.714] FlushFileBuffers (hFile=0x368) returned 1 [0085.301] FlushFileBuffers (hFile=0x334) returned 1 [0085.325] CloseHandle (hObject=0x368) returned 1 [0085.328] CloseHandle (hObject=0x334) returned 1 [0085.330] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0085.331] SetEvent (hEvent=0x2f0) returned 1 [0085.332] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0085.332] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=3069) returned 1 [0085.332] CloseHandle (hObject=0x334) returned 1 [0085.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0085.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0085.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.332] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0085.332] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.332] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.333] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0085.334] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xbfd, lpOverlapped=0x0) returned 1 [0085.336] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xc00, lpOverlapped=0x0) returned 1 [0085.337] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0085.337] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.337] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.337] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xbfd, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xbfd, lpOverlapped=0x0) returned 1 [0085.337] FlushFileBuffers (hFile=0x334) returned 1 [0085.345] FlushFileBuffers (hFile=0x368) returned 1 [0085.350] CloseHandle (hObject=0x334) returned 1 [0085.351] CloseHandle (hObject=0x368) returned 1 [0085.352] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0085.353] SetEvent (hEvent=0x2f0) returned 1 [0085.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0085.353] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=79996) returned 1 [0085.353] CloseHandle (hObject=0x368) returned 1 [0085.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0085.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0085.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0085.353] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.353] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.354] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0085.354] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x1387c, lpOverlapped=0x0) returned 1 [0085.356] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x13880, lpOverlapped=0x0) returned 1 [0085.358] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0085.358] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.358] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.358] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x1387c, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x1387c, lpOverlapped=0x0) returned 1 [0085.359] FlushFileBuffers (hFile=0x368) returned 1 [0085.738] FlushFileBuffers (hFile=0x334) returned 1 [0085.746] CloseHandle (hObject=0x368) returned 1 [0085.748] CloseHandle (hObject=0x334) returned 1 [0085.750] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0085.751] SetEvent (hEvent=0x2f0) returned 1 [0085.751] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0085.752] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=201796) returned 1 [0085.752] CloseHandle (hObject=0x334) returned 1 [0085.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0085.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0085.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.752] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0085.752] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.752] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.752] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0085.752] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x31444, lpOverlapped=0x0) returned 1 [0085.756] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x31450, lpOverlapped=0x0) returned 1 [0085.760] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0085.760] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.760] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.760] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x31444, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x31444, lpOverlapped=0x0) returned 1 [0085.761] FlushFileBuffers (hFile=0x334) returned 1 [0085.764] FlushFileBuffers (hFile=0x368) returned 1 [0085.775] CloseHandle (hObject=0x334) returned 1 [0085.778] CloseHandle (hObject=0x368) returned 1 [0085.782] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0085.784] SetEvent (hEvent=0x2f0) returned 1 [0085.784] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0085.785] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=39042) returned 1 [0085.785] CloseHandle (hObject=0x368) returned 1 [0085.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0085.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0085.786] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.786] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0085.786] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.786] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.786] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0085.792] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x9882, lpOverlapped=0x0) returned 1 [0085.796] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x9890, lpOverlapped=0x0) returned 1 [0085.808] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0085.809] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.809] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.809] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x9882, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x9882, lpOverlapped=0x0) returned 1 [0085.809] FlushFileBuffers (hFile=0x368) returned 1 [0085.815] FlushFileBuffers (hFile=0x334) returned 1 [0085.818] CloseHandle (hObject=0x368) returned 1 [0085.820] CloseHandle (hObject=0x334) returned 1 [0085.821] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0085.822] SetEvent (hEvent=0x2f0) returned 1 [0085.822] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0085.822] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=88533) returned 1 [0085.822] CloseHandle (hObject=0x334) returned 1 [0085.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0085.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0085.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.823] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0085.823] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.823] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.823] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0085.823] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x159d5, lpOverlapped=0x0) returned 1 [0085.826] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x159e0, lpOverlapped=0x0) returned 1 [0085.828] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0085.828] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.828] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.829] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x159d5, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x159d5, lpOverlapped=0x0) returned 1 [0085.829] FlushFileBuffers (hFile=0x334) returned 1 [0085.851] FlushFileBuffers (hFile=0x368) returned 1 [0085.860] CloseHandle (hObject=0x334) returned 1 [0085.862] CloseHandle (hObject=0x368) returned 1 [0085.864] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0085.865] SetEvent (hEvent=0x2f0) returned 1 [0085.865] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0085.865] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=39050) returned 1 [0085.865] CloseHandle (hObject=0x368) returned 1 [0085.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0085.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0085.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.866] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0085.866] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.866] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0085.866] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0085.868] ReadFile (in: hFile=0x368, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x988a, lpOverlapped=0x0) returned 1 [0085.869] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x9890, lpOverlapped=0x0) returned 1 [0085.871] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0085.871] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.871] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0085.871] WriteFile (in: hFile=0x368, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x988a, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x988a, lpOverlapped=0x0) returned 1 [0085.871] FlushFileBuffers (hFile=0x368) returned 1 [0086.026] FlushFileBuffers (hFile=0x334) returned 1 [0086.034] CloseHandle (hObject=0x368) returned 1 [0086.035] CloseHandle (hObject=0x334) returned 1 [0086.044] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0086.045] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.047] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=894) returned 1 [0086.047] CloseHandle (hObject=0x334) returned 1 [0086.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0086.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0086.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.047] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.047] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.047] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.047] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0086.048] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x37e, lpOverlapped=0x0) returned 1 [0086.050] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x380, lpOverlapped=0x0) returned 1 [0086.051] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.051] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.051] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.052] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.052] FlushFileBuffers (hFile=0x334) returned 1 [0086.056] FlushFileBuffers (hFile=0x254) returned 1 [0086.057] CloseHandle (hObject=0x334) returned 1 [0086.057] CloseHandle (hObject=0x254) returned 1 [0086.058] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0086.059] SetEvent (hEvent=0x2f0) returned 1 [0086.059] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.059] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=894) returned 1 [0086.059] CloseHandle (hObject=0x254) returned 1 [0086.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0086.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0086.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.059] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.059] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.059] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.060] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0086.060] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x37e, lpOverlapped=0x0) returned 1 [0086.061] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x380, lpOverlapped=0x0) returned 1 [0086.062] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.062] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.062] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.062] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.062] FlushFileBuffers (hFile=0x254) returned 1 [0086.155] FlushFileBuffers (hFile=0x334) returned 1 [0086.157] CloseHandle (hObject=0x254) returned 1 [0086.157] CloseHandle (hObject=0x334) returned 1 [0086.158] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0086.159] SetEvent (hEvent=0x2f0) returned 1 [0086.159] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.159] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=894) returned 1 [0086.160] CloseHandle (hObject=0x334) returned 1 [0086.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0086.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0086.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.160] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.160] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.160] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.160] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0086.160] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x37e, lpOverlapped=0x0) returned 1 [0086.162] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x380, lpOverlapped=0x0) returned 1 [0086.163] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.163] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.163] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.163] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.163] FlushFileBuffers (hFile=0x334) returned 1 [0086.204] FlushFileBuffers (hFile=0x254) returned 1 [0086.207] CloseHandle (hObject=0x334) returned 1 [0086.207] CloseHandle (hObject=0x254) returned 1 [0086.208] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0086.209] SetEvent (hEvent=0x2f0) returned 1 [0086.209] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.209] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=894) returned 1 [0086.209] CloseHandle (hObject=0x254) returned 1 [0086.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0086.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0086.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.209] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.209] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.210] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.210] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0086.210] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x37e, lpOverlapped=0x0) returned 1 [0086.215] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x380, lpOverlapped=0x0) returned 1 [0086.216] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.216] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.216] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.216] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.216] FlushFileBuffers (hFile=0x254) returned 1 [0086.220] FlushFileBuffers (hFile=0x334) returned 1 [0086.222] CloseHandle (hObject=0x254) returned 1 [0086.222] CloseHandle (hObject=0x334) returned 1 [0086.223] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0086.224] SetEvent (hEvent=0x2f0) returned 1 [0086.224] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.224] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=894) returned 1 [0086.224] CloseHandle (hObject=0x334) returned 1 [0086.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0086.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0086.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.231] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.231] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.231] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.231] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0086.231] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x37e, lpOverlapped=0x0) returned 1 [0086.234] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x380, lpOverlapped=0x0) returned 1 [0086.235] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.235] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.235] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.235] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.235] FlushFileBuffers (hFile=0x334) returned 1 [0086.242] FlushFileBuffers (hFile=0x254) returned 1 [0086.246] CloseHandle (hObject=0x334) returned 1 [0086.246] CloseHandle (hObject=0x254) returned 1 [0086.246] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0086.247] SetEvent (hEvent=0x2f0) returned 1 [0086.247] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.247] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=1150) returned 1 [0086.248] CloseHandle (hObject=0x254) returned 1 [0086.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0086.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0086.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.248] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.248] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.248] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.248] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0086.249] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x47e, lpOverlapped=0x0) returned 1 [0086.251] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x480, lpOverlapped=0x0) returned 1 [0086.251] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.252] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.252] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.252] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x47e, lpOverlapped=0x0) returned 1 [0086.252] FlushFileBuffers (hFile=0x254) returned 1 [0086.262] FlushFileBuffers (hFile=0x334) returned 1 [0086.265] CloseHandle (hObject=0x254) returned 1 [0086.265] CloseHandle (hObject=0x334) returned 1 [0086.266] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0086.267] SetEvent (hEvent=0x2f0) returned 1 [0086.267] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.267] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=10134) returned 1 [0086.267] CloseHandle (hObject=0x334) returned 1 [0086.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0086.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0086.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.267] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.267] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.267] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0086.267] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0086.268] ReadFile (in: hFile=0x334, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x2796, lpOverlapped=0x0) returned 1 [0086.270] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x27a0, lpOverlapped=0x0) returned 1 [0086.271] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.272] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.272] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.272] WriteFile (in: hFile=0x334, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x2796, lpOverlapped=0x0) returned 1 [0086.272] FlushFileBuffers (hFile=0x334) returned 1 [0086.627] FlushFileBuffers (hFile=0x254) returned 1 [0086.628] CloseHandle (hObject=0x334) returned 1 [0086.629] CloseHandle (hObject=0x254) returned 1 [0086.629] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0086.631] SetEvent (hEvent=0x2f0) returned 1 [0086.631] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.631] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=181483595) returned 1 [0086.631] CloseHandle (hObject=0x254) returned 1 [0086.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0086.631] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 1 [0086.632] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0086.632] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0086.632] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0086.632] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f94a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.638] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0086.638] ReadFile (in: hFile=0x254, lpBuffer=0x1f98a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f98a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.641] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0086.641] ReadFile (in: hFile=0x254, lpBuffer=0x1f9ca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f9ca058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.705] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed0 | out: lpNewFilePointer=0x0) returned 1 [0086.705] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x1f6dfec8, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec8*=0xc0112, lpOverlapped=0x0) returned 1 [0086.718] SetEndOfFile (hFile=0x254) returned 1 [0086.718] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0086.718] WriteFile (in: hFile=0x254, lpBuffer=0x1fa0a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a14a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0086.719] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0086.719] WriteFile (in: hFile=0x254, lpBuffer=0x1fa0a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a14a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0086.720] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0086.720] WriteFile (in: hFile=0x254, lpBuffer=0x1fa0a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a14a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0086.721] FlushFileBuffers (hFile=0x254) returned 1 [0087.009] CloseHandle (hObject=0x254) returned 1 [0088.554] SetEvent (hEvent=0x2f0) returned 1 [0088.565] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0088.565] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=43131591) returned 1 [0088.565] CloseHandle (hObject=0x51c) returned 1 [0088.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0088.568] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 1 [0088.568] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0088.568] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0088.568] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0088.568] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f94a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.574] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0088.574] ReadFile (in: hFile=0x254, lpBuffer=0x1f98a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f98a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.578] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0088.578] ReadFile (in: hFile=0x254, lpBuffer=0x1f9ca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f9ca058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0088.594] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed0 | out: lpNewFilePointer=0x0) returned 1 [0088.595] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x1f6dfec8, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec8*=0xc0112, lpOverlapped=0x0) returned 1 [0089.011] SetEndOfFile (hFile=0x254) returned 1 [0089.011] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0089.011] WriteFile (in: hFile=0x254, lpBuffer=0x1fa0a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a14a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0089.013] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0089.013] WriteFile (in: hFile=0x254, lpBuffer=0x1fa0a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a14a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0089.014] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0089.014] WriteFile (in: hFile=0x254, lpBuffer=0x1fa0a14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a14a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0089.014] FlushFileBuffers (hFile=0x254) returned 1 [0089.603] CloseHandle (hObject=0x254) returned 1 [0090.558] SetEvent (hEvent=0x2f0) returned 1 [0090.558] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0090.559] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=272046) returned 1 [0090.559] CloseHandle (hObject=0x254) returned 1 [0090.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0090.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0090.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.560] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0090.560] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.560] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.560] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0090.560] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x426ae, lpOverlapped=0x0) returned 1 [0090.565] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x426b0, lpOverlapped=0x0) returned 1 [0090.570] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0090.570] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.570] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.570] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x426ae, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x426ae, lpOverlapped=0x0) returned 1 [0090.571] FlushFileBuffers (hFile=0x254) returned 1 [0090.579] FlushFileBuffers (hFile=0x4c4) returned 1 [0090.582] CloseHandle (hObject=0x254) returned 1 [0090.586] CloseHandle (hObject=0x4c4) returned 1 [0090.593] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0090.596] SetEvent (hEvent=0x2f0) returned 1 [0090.596] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0090.596] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=184832) returned 1 [0090.596] CloseHandle (hObject=0x4c4) returned 1 [0090.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0090.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0090.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.597] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0090.597] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.597] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.597] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0090.597] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x2d200, lpOverlapped=0x0) returned 1 [0090.601] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x2d210, lpOverlapped=0x0) returned 1 [0090.607] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0090.607] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.607] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.607] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x2d200, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x2d200, lpOverlapped=0x0) returned 1 [0090.608] FlushFileBuffers (hFile=0x4c4) returned 1 [0090.761] FlushFileBuffers (hFile=0x254) returned 1 [0090.763] CloseHandle (hObject=0x4c4) returned 1 [0090.767] CloseHandle (hObject=0x254) returned 1 [0090.770] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0090.772] SetEvent (hEvent=0x2f0) returned 1 [0090.773] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0090.773] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=94720) returned 1 [0090.773] CloseHandle (hObject=0x254) returned 1 [0090.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0090.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0090.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.773] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0090.773] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.773] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.773] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0090.777] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x17200, lpOverlapped=0x0) returned 1 [0090.782] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x17210, lpOverlapped=0x0) returned 1 [0090.785] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0090.785] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.785] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.785] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x17200, lpOverlapped=0x0) returned 1 [0090.786] FlushFileBuffers (hFile=0x254) returned 1 [0090.914] FlushFileBuffers (hFile=0x4c4) returned 1 [0090.918] CloseHandle (hObject=0x254) returned 1 [0090.921] CloseHandle (hObject=0x4c4) returned 1 [0090.923] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0090.924] SetEvent (hEvent=0x2f0) returned 1 [0090.924] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0090.925] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=807256) returned 1 [0090.925] CloseHandle (hObject=0x4c4) returned 1 [0090.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0090.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0090.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.925] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0090.925] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.925] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0090.925] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0090.925] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xc5158, lpOverlapped=0x0) returned 1 [0090.939] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xc5160, lpOverlapped=0x0) returned 1 [0090.952] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0090.952] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.952] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0090.952] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc5158, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xc5158, lpOverlapped=0x0) returned 1 [0090.954] FlushFileBuffers (hFile=0x4c4) returned 1 [0091.022] FlushFileBuffers (hFile=0x254) returned 1 [0091.024] CloseHandle (hObject=0x4c4) returned 1 [0091.036] CloseHandle (hObject=0x254) returned 1 [0091.056] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0091.064] SetEvent (hEvent=0x2f0) returned 1 [0091.064] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0091.064] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=30120) returned 1 [0091.064] CloseHandle (hObject=0x254) returned 1 [0091.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0091.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0091.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.064] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0091.064] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0091.064] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0091.064] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0091.065] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x75a8, lpOverlapped=0x0) returned 1 [0091.247] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x75b0, lpOverlapped=0x0) returned 1 [0091.248] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0091.248] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0091.248] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0091.248] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x75a8, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x75a8, lpOverlapped=0x0) returned 1 [0091.248] FlushFileBuffers (hFile=0x254) returned 1 [0091.309] FlushFileBuffers (hFile=0x4c4) returned 1 [0091.312] CloseHandle (hObject=0x254) returned 1 [0091.313] CloseHandle (hObject=0x4c4) returned 1 [0091.314] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0091.315] SetEvent (hEvent=0x2f0) returned 1 [0091.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0091.316] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=41080) returned 1 [0091.316] CloseHandle (hObject=0x4c4) returned 1 [0091.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0091.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0091.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0091.316] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0091.316] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0091.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0091.317] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xa078, lpOverlapped=0x0) returned 1 [0091.322] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xa080, lpOverlapped=0x0) returned 1 [0091.324] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0091.324] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0091.324] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0091.324] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xa078, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xa078, lpOverlapped=0x0) returned 1 [0091.324] FlushFileBuffers (hFile=0x4c4) returned 1 [0091.485] FlushFileBuffers (hFile=0x254) returned 1 [0091.488] CloseHandle (hObject=0x4c4) returned 1 [0091.489] CloseHandle (hObject=0x254) returned 1 [0091.491] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0091.492] SetEvent (hEvent=0x2f0) returned 1 [0091.492] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0091.492] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=14084) returned 1 [0091.492] CloseHandle (hObject=0x254) returned 1 [0091.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0091.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0091.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0091.493] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0091.493] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0091.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0091.493] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x3704, lpOverlapped=0x0) returned 1 [0091.496] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x3710, lpOverlapped=0x0) returned 1 [0091.497] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0091.497] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0091.497] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0091.497] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x3704, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x3704, lpOverlapped=0x0) returned 1 [0091.497] FlushFileBuffers (hFile=0x254) returned 1 [0091.602] FlushFileBuffers (hFile=0x4c4) returned 1 [0091.606] CloseHandle (hObject=0x254) returned 1 [0091.607] CloseHandle (hObject=0x4c4) returned 1 [0091.607] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0091.608] SetEvent (hEvent=0x2f0) returned 1 [0091.609] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0091.612] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=5198099) returned 1 [0091.612] CloseHandle (hObject=0x4c4) returned 1 [0091.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0091.612] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 1 [0091.612] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0091.612] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0091.613] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0091.613] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f94a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f94a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0091.618] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0091.618] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f98a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f98a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0091.624] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0091.624] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f9ca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f9ca058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0091.637] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed0 | out: lpNewFilePointer=0x0) returned 1 [0091.637] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x1f6dfec8, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec8*=0xc0132, lpOverlapped=0x0) returned 1 [0091.836] SetEndOfFile (hFile=0x4c4) returned 1 [0091.836] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0091.836] WriteFile (in: hFile=0x4c4, lpBuffer=0x1fa0a16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a16a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0091.838] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0091.838] WriteFile (in: hFile=0x4c4, lpBuffer=0x1fa0a16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a16a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0091.840] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0091.841] WriteFile (in: hFile=0x4c4, lpBuffer=0x1fa0a16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a16a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0091.842] FlushFileBuffers (hFile=0x4c4) returned 1 [0091.980] CloseHandle (hObject=0x4c4) returned 1 [0092.402] SetEvent (hEvent=0x2f0) returned 1 [0092.402] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0092.402] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=2141433) returned 1 [0092.402] CloseHandle (hObject=0x4c4) returned 1 [0092.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0092.403] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 1 [0092.403] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0092.403] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0092.403] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0092.403] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f94a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f94a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0092.407] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0092.407] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f98a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f98a058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0092.409] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd60 | out: lpNewFilePointer=0x0) returned 1 [0092.409] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f9ca058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f6dfd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f9ca058*, lpNumberOfBytesRead=0x1f6dfd6c*=0x40000, lpOverlapped=0x0) returned 1 [0092.428] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed0 | out: lpNewFilePointer=0x0) returned 1 [0092.428] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x1f6dfec8, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec8*=0xc0132, lpOverlapped=0x0) returned 1 [0092.439] SetEndOfFile (hFile=0x4c4) returned 1 [0092.439] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0092.439] WriteFile (in: hFile=0x4c4, lpBuffer=0x1fa0a16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a16a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0092.440] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0092.440] WriteFile (in: hFile=0x4c4, lpBuffer=0x1fa0a16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a16a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0092.442] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfd68 | out: lpNewFilePointer=0x0) returned 1 [0092.442] WriteFile (in: hFile=0x4c4, lpBuffer=0x1fa0a16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f6dfd74, lpOverlapped=0x0 | out: lpBuffer=0x1fa0a16a*, lpNumberOfBytesWritten=0x1f6dfd74*=0x40000, lpOverlapped=0x0) returned 1 [0092.443] FlushFileBuffers (hFile=0x4c4) returned 1 [0092.451] CloseHandle (hObject=0x4c4) returned 1 [0092.776] SetEvent (hEvent=0x2f0) returned 1 [0092.777] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.777] SetEvent (hEvent=0x2f0) returned 1 [0092.778] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.778] SetEvent (hEvent=0x2f0) returned 1 [0092.778] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0092.778] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=0) returned 1 [0092.778] CloseHandle (hObject=0x6c8) returned 1 [0092.778] SetEvent (hEvent=0x2f0) returned 1 [0092.779] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0092.779] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=0) returned 1 [0092.779] CloseHandle (hObject=0x6c8) returned 1 [0092.779] SetEvent (hEvent=0x2f0) returned 1 [0092.779] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0092.780] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=77664) returned 1 [0092.780] CloseHandle (hObject=0x6c8) returned 1 [0092.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0092.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0092.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.780] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.780] SetEvent (hEvent=0x2f0) returned 1 [0092.780] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0092.782] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=95648) returned 1 [0092.782] CloseHandle (hObject=0x6c8) returned 1 [0092.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0092.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0092.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.782] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.782] SetEvent (hEvent=0x2f0) returned 1 [0092.782] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0092.938] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=65536) returned 1 [0092.938] CloseHandle (hObject=0x51c) returned 1 [0092.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0092.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0092.938] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.938] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0092.938] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0092.938] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0092.938] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x4d4 [0092.939] ReadFile (in: hFile=0x51c, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x10000, lpOverlapped=0x0) returned 1 [0092.941] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x10010, lpOverlapped=0x0) returned 1 [0092.942] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf2, lpOverlapped=0x0) returned 1 [0092.943] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0092.943] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0092.943] WriteFile (in: hFile=0x51c, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x10000, lpOverlapped=0x0) returned 1 [0092.943] FlushFileBuffers (hFile=0x51c) returned 1 [0092.944] FlushFileBuffers (hFile=0x4d4) returned 1 [0092.945] CloseHandle (hObject=0x51c) returned 1 [0092.947] CloseHandle (hObject=0x4d4) returned 1 [0092.950] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0092.951] SetEvent (hEvent=0x2f0) returned 1 [0092.951] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.951] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=45472) returned 1 [0092.951] CloseHandle (hObject=0x4d4) returned 1 [0092.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0092.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0092.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.951] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.952] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.954] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=76640) returned 1 [0092.954] CloseHandle (hObject=0x4d4) returned 1 [0092.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0092.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0092.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.954] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.954] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.954] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=45984) returned 1 [0092.954] CloseHandle (hObject=0x4d4) returned 1 [0092.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0092.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0092.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.955] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.955] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.955] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=74080) returned 1 [0092.955] CloseHandle (hObject=0x4d4) returned 1 [0092.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0092.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0092.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.955] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.955] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.955] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=54168) returned 1 [0092.956] CloseHandle (hObject=0x4d4) returned 1 [0092.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0092.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0092.956] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.956] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.956] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.956] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=92576) returned 1 [0092.956] CloseHandle (hObject=0x4d4) returned 1 [0092.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0092.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0092.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.958] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.958] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=12192) returned 1 [0092.958] CloseHandle (hObject=0x4d4) returned 1 [0092.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0092.958] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0092.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.959] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=76128) returned 1 [0092.959] CloseHandle (hObject=0x4d4) returned 1 [0092.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0092.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0092.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.959] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.959] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=77152) returned 1 [0092.960] CloseHandle (hObject=0x4d4) returned 1 [0092.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0092.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0092.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.960] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=44960) returned 1 [0092.960] CloseHandle (hObject=0x4d4) returned 1 [0092.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0092.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0092.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.960] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.961] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=77144) returned 1 [0092.961] CloseHandle (hObject=0x4d4) returned 1 [0092.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0092.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0092.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.961] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.961] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.961] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=76640) returned 1 [0092.961] CloseHandle (hObject=0x4d4) returned 1 [0092.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0092.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0092.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.961] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.962] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=77152) returned 1 [0092.962] CloseHandle (hObject=0x4d4) returned 1 [0092.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0092.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0092.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.962] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.962] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=44888) returned 1 [0092.962] CloseHandle (hObject=0x4d4) returned 1 [0092.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0092.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0092.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.963] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=77152) returned 1 [0092.963] CloseHandle (hObject=0x4d4) returned 1 [0092.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0092.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0092.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.963] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.963] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=76128) returned 1 [0092.964] CloseHandle (hObject=0x4d4) returned 1 [0092.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0092.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0092.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.964] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.964] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.964] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=44952) returned 1 [0092.964] CloseHandle (hObject=0x4d4) returned 1 [0092.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0092.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0092.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.965] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=75096) returned 1 [0092.965] CloseHandle (hObject=0x4d4) returned 1 [0092.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0092.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0092.965] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.965] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.965] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=45472) returned 1 [0092.966] CloseHandle (hObject=0x4d4) returned 1 [0092.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0092.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0092.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0092.966] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=77152) returned 1 [0092.966] CloseHandle (hObject=0x4d4) returned 1 [0092.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0092.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0092.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.966] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.967] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.969] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=4662) returned 1 [0092.969] CloseHandle (hObject=0x254) returned 1 [0092.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0092.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0092.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.969] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.969] SetEvent (hEvent=0x2f0) returned 1 [0092.969] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.969] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=63840) returned 1 [0092.969] CloseHandle (hObject=0x254) returned 1 [0092.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0092.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0092.969] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.970] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.970] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.970] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=42400) returned 1 [0092.970] CloseHandle (hObject=0x254) returned 1 [0092.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0092.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0092.970] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.970] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.970] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.970] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=63832) returned 1 [0092.970] CloseHandle (hObject=0x254) returned 1 [0092.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0092.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0092.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.971] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.971] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.971] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=42328) returned 1 [0092.971] CloseHandle (hObject=0x254) returned 1 [0092.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0092.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0092.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.971] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.971] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.972] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=63840) returned 1 [0092.972] CloseHandle (hObject=0x254) returned 1 [0092.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0092.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0092.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.972] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.972] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.972] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=42392) returned 1 [0092.972] CloseHandle (hObject=0x254) returned 1 [0092.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0092.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0092.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.972] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.973] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.974] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=395226) returned 1 [0092.974] CloseHandle (hObject=0x254) returned 1 [0092.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0092.974] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0092.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0092.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootmgr.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.974] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.974] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0092.974] SetEvent (hEvent=0x2f0) returned 1 [0092.974] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.976] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=1) returned 1 [0092.976] CloseHandle (hObject=0x254) returned 1 [0092.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26 [0092.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26 [0092.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootnxt.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.976] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.976] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0092.976] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0092.976] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootnxt.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x4d4 [0092.977] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x1, lpOverlapped=0x0) returned 1 [0092.978] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x10, lpOverlapped=0x0) returned 1 [0092.978] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xe2, lpOverlapped=0x0) returned 1 [0092.979] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0092.979] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0092.979] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x1, lpOverlapped=0x0) returned 1 [0092.979] FlushFileBuffers (hFile=0x254) returned 1 [0093.076] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.078] CloseHandle (hObject=0x254) returned 1 [0093.079] CloseHandle (hObject=0x4d4) returned 1 [0093.080] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0093.081] SetEvent (hEvent=0x2f0) returned 1 [0093.081] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.081] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.083] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.083] CloseHandle (hObject=0x4d4) returned 1 [0093.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0093.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0093.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\application.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.084] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.084] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.084] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.084] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\application.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x254 [0093.084] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.086] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.088] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x102, lpOverlapped=0x0) returned 1 [0093.088] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.088] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.088] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.089] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.251] FlushFileBuffers (hFile=0x254) returned 1 [0093.254] CloseHandle (hObject=0x4d4) returned 1 [0093.256] CloseHandle (hObject=0x254) returned 1 [0093.258] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0093.259] SetEvent (hEvent=0x2f0) returned 1 [0093.260] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.260] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.260] CloseHandle (hObject=0x254) returned 1 [0093.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0093.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0093.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.260] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.260] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.260] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.260] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x4d4 [0093.261] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.265] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.267] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x112, lpOverlapped=0x0) returned 1 [0093.267] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.267] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.267] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.268] FlushFileBuffers (hFile=0x254) returned 1 [0093.272] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.285] CloseHandle (hObject=0x254) returned 1 [0093.287] CloseHandle (hObject=0x4d4) returned 1 [0093.289] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0093.290] SetEvent (hEvent=0x2f0) returned 1 [0093.290] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.292] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.292] CloseHandle (hObject=0x4d4) returned 1 [0093.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0093.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0093.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.293] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.293] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.293] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.293] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x254 [0093.293] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.295] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.297] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x172, lpOverlapped=0x0) returned 1 [0093.297] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.297] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.297] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.297] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.306] FlushFileBuffers (hFile=0x254) returned 1 [0093.339] CloseHandle (hObject=0x4d4) returned 1 [0093.341] CloseHandle (hObject=0x254) returned 1 [0093.343] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0093.344] SetEvent (hEvent=0x2f0) returned 1 [0093.344] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.345] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.345] CloseHandle (hObject=0x254) returned 1 [0093.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0093.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0093.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.345] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.345] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.345] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.345] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x4d4 [0093.346] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.349] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.350] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x132, lpOverlapped=0x0) returned 1 [0093.351] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.351] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.351] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.351] FlushFileBuffers (hFile=0x254) returned 1 [0093.567] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.569] CloseHandle (hObject=0x254) returned 1 [0093.570] CloseHandle (hObject=0x4d4) returned 1 [0093.572] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0093.573] SetEvent (hEvent=0x2f0) returned 1 [0093.573] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.574] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.574] CloseHandle (hObject=0x4d4) returned 1 [0093.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0093.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0093.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.574] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.574] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.574] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.574] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x254 [0093.575] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.577] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.579] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x152, lpOverlapped=0x0) returned 1 [0093.579] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.579] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.579] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.579] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.582] FlushFileBuffers (hFile=0x254) returned 1 [0093.583] CloseHandle (hObject=0x4d4) returned 1 [0093.584] CloseHandle (hObject=0x254) returned 1 [0093.586] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0093.588] SetEvent (hEvent=0x2f0) returned 1 [0093.588] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.588] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.588] CloseHandle (hObject=0x254) returned 1 [0093.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0093.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0093.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.590] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.590] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.590] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.590] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x4d4 [0093.590] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.593] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.594] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x152, lpOverlapped=0x0) returned 1 [0093.595] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.595] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.595] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.595] FlushFileBuffers (hFile=0x254) returned 1 [0093.597] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.599] CloseHandle (hObject=0x254) returned 1 [0093.600] CloseHandle (hObject=0x4d4) returned 1 [0093.602] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0093.604] SetEvent (hEvent=0x2f0) returned 1 [0093.605] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.605] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.605] CloseHandle (hObject=0x4d4) returned 1 [0093.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0093.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0093.605] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.605] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.605] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.605] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.605] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x254 [0093.606] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.608] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.610] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x132, lpOverlapped=0x0) returned 1 [0093.610] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.610] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.610] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.611] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.613] FlushFileBuffers (hFile=0x254) returned 1 [0093.615] CloseHandle (hObject=0x4d4) returned 1 [0093.616] CloseHandle (hObject=0x254) returned 1 [0093.618] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0093.619] SetEvent (hEvent=0x2f0) returned 1 [0093.619] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.619] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=69632) returned 1 [0093.619] CloseHandle (hObject=0x254) returned 1 [0093.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0093.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0093.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.620] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.620] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.620] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.620] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x4d4 [0093.620] ReadFile (in: hFile=0x254, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x11000, lpOverlapped=0x0) returned 1 [0093.623] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.625] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x132, lpOverlapped=0x0) returned 1 [0093.625] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.626] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.626] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.626] FlushFileBuffers (hFile=0x254) returned 1 [0093.628] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.630] CloseHandle (hObject=0x254) returned 1 [0093.631] CloseHandle (hObject=0x4d4) returned 1 [0093.633] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0093.634] SetEvent (hEvent=0x2f0) returned 1 [0093.634] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.639] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=1118208) returned 1 [0093.640] CloseHandle (hObject=0x4d4) returned 1 [0093.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0093.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0093.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.640] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0093.640] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.640] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfed8 | out: lpNewFilePointer=0x0) returned 1 [0093.640] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x254 [0093.640] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0x110100, lpOverlapped=0x0) returned 1 [0093.666] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x110100, lpOverlapped=0x0) returned 1 [0093.759] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f94a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f6dfeec, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesRead=0x1f6dfeec*=0xf00, lpOverlapped=0x0) returned 1 [0093.759] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0xf10, lpOverlapped=0x0) returned 1 [0093.759] WriteFile (in: hFile=0x254, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x1f6dfec4, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfec4*=0x142, lpOverlapped=0x0) returned 1 [0093.760] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.760] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f6dfc38 | out: lpNewFilePointer=0x0) returned 1 [0093.760] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0x110102, lpOverlapped=0x0) returned 1 [0093.770] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f94a020*, nNumberOfBytesToWrite=0xefe, lpNumberOfBytesWritten=0x1f6dfc44, lpOverlapped=0x0 | out: lpBuffer=0x1f94a020*, lpNumberOfBytesWritten=0x1f6dfc44*=0xefe, lpOverlapped=0x0) returned 1 [0093.770] FlushFileBuffers (hFile=0x4d4) returned 1 [0093.775] FlushFileBuffers (hFile=0x254) returned 1 [0093.940] CloseHandle (hObject=0x4d4) returned 1 [0093.956] CloseHandle (hObject=0x254) returned 1 [0093.980] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0093.989] SetEvent (hEvent=0x2f0) returned 1 [0093.989] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0093.990] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f6dff10 | out: lpFileSize=0x1f6dff10*=2166784) returned 1 [0093.990] CloseHandle (hObject=0x254) returned 1 [0093.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0093.990] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) Thread: id = 17 os_tid = 0xa24 [0063.237] GetCurrentThreadId () returned 0xa24 [0063.246] GetProcessHeap () returned 0x580000 [0063.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x609f88 [0063.251] GetProcessHeap () returned 0x580000 [0063.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x619f90 [0063.256] GetProcessHeap () returned 0x580000 [0063.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x5c3438 [0063.262] GetProcessHeap () returned 0x580000 [0063.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x110102) returned 0x1f827020 [0063.270] GetProcessHeap () returned 0x580000 [0063.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x5a8880 [0063.447] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0063.447] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0063.447] Wow64DisableWow64FsRedirection (in: OldValue=0x1f81ff68 | out: OldValue=0x1f81ff68*=0x0) returned 1 [0063.447] GetProcessHeap () returned 0x580000 [0063.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a8880 | out: hHeap=0x580000) returned 1 [0063.456] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0xffffffff) returned 0x0 [0063.465] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0xffffffff) returned 0x0 [0063.474] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0xffffffff) returned 0x0 [0063.715] ResetEvent (hEvent=0x2f4) returned 1 [0063.715] SetEvent (hEvent=0x2f8) returned 1 [0063.772] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.773] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=6004) returned 1 [0063.773] CloseHandle (hObject=0x338) returned 1 [0063.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0063.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0063.773] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0063.773] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0063.774] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0063.774] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0063.774] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x33c [0063.774] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x1774, lpOverlapped=0x0) returned 1 [0063.793] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x1780, lpOverlapped=0x0) returned 1 [0063.794] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x122, lpOverlapped=0x0) returned 1 [0063.794] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0063.794] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0063.794] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1774, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x1774, lpOverlapped=0x0) returned 1 [0063.795] FlushFileBuffers (hFile=0x338) returned 1 [0064.665] FlushFileBuffers (hFile=0x33c) returned 1 [0064.667] CloseHandle (hObject=0x338) returned 1 [0064.668] CloseHandle (hObject=0x33c) returned 1 [0064.669] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0065.533] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.534] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=40) returned 1 [0065.534] CloseHandle (hObject=0x338) returned 1 [0065.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0065.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0065.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0065.534] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.534] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0065.534] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0065.534] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0065.536] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x28, lpOverlapped=0x0) returned 1 [0065.537] WriteFile (in: hFile=0x360, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x30, lpOverlapped=0x0) returned 1 [0065.538] WriteFile (in: hFile=0x360, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x112, lpOverlapped=0x0) returned 1 [0065.538] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0065.538] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0065.538] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x28, lpOverlapped=0x0) returned 1 [0065.538] FlushFileBuffers (hFile=0x338) returned 1 [0065.613] FlushFileBuffers (hFile=0x360) returned 1 [0065.688] CloseHandle (hObject=0x338) returned 1 [0065.689] CloseHandle (hObject=0x360) returned 1 [0065.691] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0065.720] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0065.721] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=577) returned 1 [0065.721] CloseHandle (hObject=0x360) returned 1 [0065.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0065.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0065.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0065.721] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0065.721] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0065.721] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0065.721] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x338 [0065.722] ReadFile (in: hFile=0x360, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x241, lpOverlapped=0x0) returned 1 [0066.068] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x250, lpOverlapped=0x0) returned 1 [0066.069] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x112, lpOverlapped=0x0) returned 1 [0066.069] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0066.069] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0066.069] WriteFile (in: hFile=0x360, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x241, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x241, lpOverlapped=0x0) returned 1 [0066.069] FlushFileBuffers (hFile=0x360) returned 1 [0066.071] FlushFileBuffers (hFile=0x338) returned 1 [0066.072] CloseHandle (hObject=0x360) returned 1 [0066.073] CloseHandle (hObject=0x338) returned 1 [0066.073] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0066.102] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0066.103] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=307) returned 1 [0066.103] CloseHandle (hObject=0x338) returned 1 [0066.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0066.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0066.103] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0066.103] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0066.103] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0066.103] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0066.103] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x360 [0066.104] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x133, lpOverlapped=0x0) returned 1 [0066.348] WriteFile (in: hFile=0x360, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x140, lpOverlapped=0x0) returned 1 [0066.349] WriteFile (in: hFile=0x360, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0066.350] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0066.350] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0066.350] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x133, lpOverlapped=0x0) returned 1 [0066.350] FlushFileBuffers (hFile=0x338) returned 1 [0066.877] FlushFileBuffers (hFile=0x360) returned 1 [0066.883] CloseHandle (hObject=0x338) returned 1 [0066.884] CloseHandle (hObject=0x360) returned 1 [0066.884] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0066.943] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0066.993] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=7567) returned 1 [0066.993] CloseHandle (hObject=0x30c) returned 1 [0066.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0066.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0066.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0066.994] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0066.994] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0066.994] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0066.994] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0067.048] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x1d8f, lpOverlapped=0x0) returned 1 [0067.049] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x1d90, lpOverlapped=0x0) returned 1 [0067.050] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0067.050] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0067.050] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0067.050] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1d8f, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x1d8f, lpOverlapped=0x0) returned 1 [0067.051] FlushFileBuffers (hFile=0x30c) returned 1 [0067.056] FlushFileBuffers (hFile=0x334) returned 1 [0067.057] CloseHandle (hObject=0x30c) returned 1 [0067.058] CloseHandle (hObject=0x334) returned 1 [0067.059] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0067.087] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0067.088] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=17240) returned 1 [0067.088] CloseHandle (hObject=0x334) returned 1 [0067.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0067.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0067.088] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0067.088] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0067.088] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0067.088] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0067.088] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0067.089] ReadFile (in: hFile=0x334, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x4358, lpOverlapped=0x0) returned 1 [0067.350] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x4360, lpOverlapped=0x0) returned 1 [0067.352] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0067.352] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0067.352] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0067.352] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4358, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x4358, lpOverlapped=0x0) returned 1 [0067.352] FlushFileBuffers (hFile=0x334) returned 1 [0067.363] FlushFileBuffers (hFile=0x30c) returned 1 [0067.378] CloseHandle (hObject=0x334) returned 1 [0067.379] CloseHandle (hObject=0x30c) returned 1 [0067.380] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0067.407] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0067.407] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=6309) returned 1 [0067.407] CloseHandle (hObject=0x30c) returned 1 [0067.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0067.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0067.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0067.407] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0067.408] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0067.408] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0067.408] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0067.409] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x18a5, lpOverlapped=0x0) returned 1 [0067.643] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x18b0, lpOverlapped=0x0) returned 1 [0067.644] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0067.644] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0067.644] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0067.644] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x18a5, lpOverlapped=0x0) returned 1 [0067.644] FlushFileBuffers (hFile=0x30c) returned 1 [0067.886] FlushFileBuffers (hFile=0x338) returned 1 [0067.934] CloseHandle (hObject=0x30c) returned 1 [0067.934] CloseHandle (hObject=0x338) returned 1 [0067.935] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0068.083] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0068.084] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=14168) returned 1 [0068.084] CloseHandle (hObject=0x338) returned 1 [0068.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0068.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0068.085] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0068.085] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0068.085] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0068.085] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0068.085] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0068.085] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x3758, lpOverlapped=0x0) returned 1 [0068.119] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x3760, lpOverlapped=0x0) returned 1 [0068.120] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0068.121] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0068.121] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0068.121] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x3758, lpOverlapped=0x0) returned 1 [0068.121] FlushFileBuffers (hFile=0x338) returned 1 [0068.433] FlushFileBuffers (hFile=0x30c) returned 1 [0068.438] CloseHandle (hObject=0x338) returned 1 [0068.439] CloseHandle (hObject=0x30c) returned 1 [0068.439] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0068.468] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0068.468] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=80970) returned 1 [0068.468] CloseHandle (hObject=0x30c) returned 1 [0068.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0068.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0068.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0068.469] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0068.469] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0068.469] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0068.469] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0068.510] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x13c4a, lpOverlapped=0x0) returned 1 [0068.698] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x13c50, lpOverlapped=0x0) returned 1 [0068.700] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0068.700] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0068.700] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0068.700] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13c4a, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x13c4a, lpOverlapped=0x0) returned 1 [0068.701] FlushFileBuffers (hFile=0x30c) returned 1 [0069.178] FlushFileBuffers (hFile=0x33c) returned 1 [0069.179] CloseHandle (hObject=0x30c) returned 1 [0069.203] CloseHandle (hObject=0x33c) returned 1 [0069.205] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0069.281] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0069.282] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3314) returned 1 [0069.282] CloseHandle (hObject=0x30c) returned 1 [0069.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0069.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0069.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0069.282] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0069.282] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0069.282] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0069.282] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0069.307] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xcf2, lpOverlapped=0x0) returned 1 [0069.308] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xd00, lpOverlapped=0x0) returned 1 [0069.309] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0069.309] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0069.309] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0069.310] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xcf2, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xcf2, lpOverlapped=0x0) returned 1 [0069.310] FlushFileBuffers (hFile=0x30c) returned 1 [0069.330] FlushFileBuffers (hFile=0x310) returned 1 [0069.346] CloseHandle (hObject=0x30c) returned 1 [0069.346] CloseHandle (hObject=0x310) returned 1 [0069.347] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0069.375] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0069.375] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=77748) returned 1 [0069.375] CloseHandle (hObject=0x310) returned 1 [0069.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0069.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0069.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0069.376] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0069.376] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0069.376] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0069.376] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0069.376] ReadFile (in: hFile=0x310, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x12fb4, lpOverlapped=0x0) returned 1 [0069.583] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x12fc0, lpOverlapped=0x0) returned 1 [0069.585] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0069.585] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0069.585] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0069.585] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12fb4, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x12fb4, lpOverlapped=0x0) returned 1 [0069.586] FlushFileBuffers (hFile=0x310) returned 1 [0070.012] FlushFileBuffers (hFile=0x30c) returned 1 [0070.013] CloseHandle (hObject=0x310) returned 1 [0070.015] CloseHandle (hObject=0x30c) returned 1 [0070.017] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0070.350] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0070.351] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3419) returned 1 [0070.351] CloseHandle (hObject=0x310) returned 1 [0070.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0070.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0070.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0070.351] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0070.351] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0070.351] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0070.351] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0070.388] ReadFile (in: hFile=0x310, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xd5b, lpOverlapped=0x0) returned 1 [0070.393] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xd60, lpOverlapped=0x0) returned 1 [0070.394] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0070.395] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0070.395] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0070.395] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xd5b, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xd5b, lpOverlapped=0x0) returned 1 [0070.395] FlushFileBuffers (hFile=0x310) returned 1 [0070.403] FlushFileBuffers (hFile=0x30c) returned 1 [0070.413] CloseHandle (hObject=0x310) returned 1 [0070.414] CloseHandle (hObject=0x30c) returned 1 [0070.415] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0070.441] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0070.442] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=82346) returned 1 [0070.442] CloseHandle (hObject=0x30c) returned 1 [0070.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0070.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0070.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0070.442] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0070.442] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0070.442] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0070.442] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0070.442] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x141aa, lpOverlapped=0x0) returned 1 [0070.449] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x141b0, lpOverlapped=0x0) returned 1 [0070.452] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0070.452] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0070.452] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0070.452] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x141aa, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x141aa, lpOverlapped=0x0) returned 1 [0070.452] FlushFileBuffers (hFile=0x30c) returned 1 [0070.464] FlushFileBuffers (hFile=0x310) returned 1 [0070.465] CloseHandle (hObject=0x30c) returned 1 [0070.467] CloseHandle (hObject=0x310) returned 1 [0070.469] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0070.657] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0070.657] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=18776) returned 1 [0070.657] CloseHandle (hObject=0x334) returned 1 [0070.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0070.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0070.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0070.658] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0070.658] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0070.658] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0070.658] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0070.658] ReadFile (in: hFile=0x334, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x4958, lpOverlapped=0x0) returned 1 [0070.704] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x4960, lpOverlapped=0x0) returned 1 [0070.705] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0070.705] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0070.705] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0070.705] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x4958, lpOverlapped=0x0) returned 1 [0070.706] FlushFileBuffers (hFile=0x334) returned 1 [0071.144] FlushFileBuffers (hFile=0x310) returned 1 [0071.146] CloseHandle (hObject=0x334) returned 1 [0071.147] CloseHandle (hObject=0x310) returned 1 [0071.148] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0071.176] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0071.176] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=19288) returned 1 [0071.176] CloseHandle (hObject=0x310) returned 1 [0071.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0071.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0071.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0071.347] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0071.347] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0071.347] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0071.347] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0071.348] ReadFile (in: hFile=0x310, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x4b58, lpOverlapped=0x0) returned 1 [0071.349] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x4b60, lpOverlapped=0x0) returned 1 [0071.350] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0071.351] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0071.351] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0071.351] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x4b58, lpOverlapped=0x0) returned 1 [0071.351] FlushFileBuffers (hFile=0x310) returned 1 [0071.627] FlushFileBuffers (hFile=0x334) returned 1 [0071.628] CloseHandle (hObject=0x310) returned 1 [0071.630] CloseHandle (hObject=0x334) returned 1 [0071.631] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0071.712] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0071.715] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=77232) returned 1 [0071.715] CloseHandle (hObject=0x338) returned 1 [0071.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0071.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0071.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0071.715] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0071.715] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0071.715] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0071.716] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0071.716] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x12db0, lpOverlapped=0x0) returned 1 [0071.721] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x12dc0, lpOverlapped=0x0) returned 1 [0071.722] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0071.723] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0071.723] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0071.723] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12db0, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x12db0, lpOverlapped=0x0) returned 1 [0071.723] FlushFileBuffers (hFile=0x338) returned 1 [0072.472] FlushFileBuffers (hFile=0x33c) returned 1 [0072.486] CloseHandle (hObject=0x338) returned 1 [0072.488] CloseHandle (hObject=0x33c) returned 1 [0072.490] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0072.517] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.517] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3702) returned 1 [0072.517] CloseHandle (hObject=0x33c) returned 1 [0072.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0072.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0072.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0072.517] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0072.518] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0072.518] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0072.518] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0072.707] ReadFile (in: hFile=0x33c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xe76, lpOverlapped=0x0) returned 1 [0072.713] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xe80, lpOverlapped=0x0) returned 1 [0072.714] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0072.714] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0072.714] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0072.714] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe76, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xe76, lpOverlapped=0x0) returned 1 [0072.714] FlushFileBuffers (hFile=0x33c) returned 1 [0072.727] FlushFileBuffers (hFile=0x310) returned 1 [0072.729] CloseHandle (hObject=0x33c) returned 1 [0072.729] CloseHandle (hObject=0x310) returned 1 [0072.730] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0072.757] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0072.757] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=18264) returned 1 [0072.757] CloseHandle (hObject=0x310) returned 1 [0072.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0072.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0072.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0072.758] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0072.758] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0072.758] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0072.758] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0072.758] ReadFile (in: hFile=0x310, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x4758, lpOverlapped=0x0) returned 1 [0072.760] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x4760, lpOverlapped=0x0) returned 1 [0072.761] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0072.761] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0072.761] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0072.761] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4758, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x4758, lpOverlapped=0x0) returned 1 [0072.761] FlushFileBuffers (hFile=0x310) returned 1 [0072.982] FlushFileBuffers (hFile=0x33c) returned 1 [0072.984] CloseHandle (hObject=0x310) returned 1 [0072.984] CloseHandle (hObject=0x33c) returned 1 [0072.985] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0073.020] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0073.020] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3526) returned 1 [0073.020] CloseHandle (hObject=0x33c) returned 1 [0073.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0073.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0073.020] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0073.061] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0073.061] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.061] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.061] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0073.063] ReadFile (in: hFile=0x310, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xdc6, lpOverlapped=0x0) returned 1 [0073.068] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xdd0, lpOverlapped=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0073.069] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.069] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.069] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xdc6, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xdc6, lpOverlapped=0x0) returned 1 [0073.069] FlushFileBuffers (hFile=0x310) returned 1 [0073.080] FlushFileBuffers (hFile=0x30c) returned 1 [0073.081] CloseHandle (hObject=0x310) returned 1 [0073.082] CloseHandle (hObject=0x30c) returned 1 [0073.083] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0073.111] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0073.111] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=82962) returned 1 [0073.111] CloseHandle (hObject=0x30c) returned 1 [0073.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0073.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0073.111] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0073.111] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0073.111] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.111] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.111] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0073.112] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x14412, lpOverlapped=0x0) returned 1 [0073.114] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x14420, lpOverlapped=0x0) returned 1 [0073.116] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0073.116] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.116] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.116] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x14412, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x14412, lpOverlapped=0x0) returned 1 [0073.117] FlushFileBuffers (hFile=0x30c) returned 1 [0073.504] FlushFileBuffers (hFile=0x310) returned 1 [0073.508] CloseHandle (hObject=0x30c) returned 1 [0073.510] CloseHandle (hObject=0x310) returned 1 [0073.512] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0073.589] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0073.589] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=6851) returned 1 [0073.589] CloseHandle (hObject=0x338) returned 1 [0073.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0073.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0073.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0073.590] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0073.590] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.591] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.591] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0073.611] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x1ac3, lpOverlapped=0x0) returned 1 [0073.612] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x1ad0, lpOverlapped=0x0) returned 1 [0073.613] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0073.613] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.613] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.613] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1ac3, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x1ac3, lpOverlapped=0x0) returned 1 [0073.614] FlushFileBuffers (hFile=0x338) returned 1 [0073.634] FlushFileBuffers (hFile=0x30c) returned 1 [0073.635] CloseHandle (hObject=0x338) returned 1 [0073.636] CloseHandle (hObject=0x30c) returned 1 [0073.636] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0073.856] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0073.890] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=72076) returned 1 [0073.890] CloseHandle (hObject=0x338) returned 1 [0073.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0073.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0073.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0073.890] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0073.890] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.890] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0073.890] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0073.890] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x1198c, lpOverlapped=0x0) returned 1 [0073.939] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x11990, lpOverlapped=0x0) returned 1 [0073.941] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0073.941] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.941] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0073.941] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1198c, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x1198c, lpOverlapped=0x0) returned 1 [0073.942] FlushFileBuffers (hFile=0x338) returned 1 [0074.009] FlushFileBuffers (hFile=0x368) returned 1 [0074.044] CloseHandle (hObject=0x338) returned 1 [0074.046] CloseHandle (hObject=0x368) returned 1 [0074.048] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0074.161] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0074.165] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=4254) returned 1 [0074.165] CloseHandle (hObject=0x30c) returned 1 [0074.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0074.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0074.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0074.165] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0074.166] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.166] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.166] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0074.167] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x109e, lpOverlapped=0x0) returned 1 [0074.171] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x10a0, lpOverlapped=0x0) returned 1 [0074.172] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0074.173] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0074.173] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0074.173] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x109e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x109e, lpOverlapped=0x0) returned 1 [0074.173] FlushFileBuffers (hFile=0x30c) returned 1 [0074.180] FlushFileBuffers (hFile=0x368) returned 1 [0074.183] CloseHandle (hObject=0x30c) returned 1 [0074.184] CloseHandle (hObject=0x368) returned 1 [0074.184] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0074.233] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.233] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=86442) returned 1 [0074.233] CloseHandle (hObject=0x368) returned 1 [0074.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0074.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0074.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0074.234] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.234] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.234] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.234] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0074.234] ReadFile (in: hFile=0x368, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x151aa, lpOverlapped=0x0) returned 1 [0074.435] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x151b0, lpOverlapped=0x0) returned 1 [0074.437] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0074.437] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0074.437] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0074.437] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x151aa, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x151aa, lpOverlapped=0x0) returned 1 [0074.437] FlushFileBuffers (hFile=0x368) returned 1 [0074.727] FlushFileBuffers (hFile=0x30c) returned 1 [0074.732] CloseHandle (hObject=0x368) returned 1 [0074.737] CloseHandle (hObject=0x30c) returned 1 [0074.739] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0074.913] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0074.918] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3643) returned 1 [0074.918] CloseHandle (hObject=0x334) returned 1 [0074.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0074.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0074.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0074.919] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0074.919] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.919] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.919] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0074.925] ReadFile (in: hFile=0x334, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xe3b, lpOverlapped=0x0) returned 1 [0074.926] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xe40, lpOverlapped=0x0) returned 1 [0074.927] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0074.927] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0074.928] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0074.928] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe3b, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xe3b, lpOverlapped=0x0) returned 1 [0074.928] FlushFileBuffers (hFile=0x334) returned 1 [0074.934] FlushFileBuffers (hFile=0x310) returned 1 [0074.940] CloseHandle (hObject=0x334) returned 1 [0074.941] CloseHandle (hObject=0x310) returned 1 [0074.941] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0074.971] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0074.971] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=80060) returned 1 [0074.971] CloseHandle (hObject=0x310) returned 1 [0074.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0074.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0074.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0074.971] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0074.972] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.972] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0074.972] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x334 [0074.972] ReadFile (in: hFile=0x310, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x138bc, lpOverlapped=0x0) returned 1 [0075.184] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x138c0, lpOverlapped=0x0) returned 1 [0075.206] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0075.207] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0075.207] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0075.207] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x138bc, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x138bc, lpOverlapped=0x0) returned 1 [0075.207] FlushFileBuffers (hFile=0x310) returned 1 [0075.841] FlushFileBuffers (hFile=0x334) returned 1 [0075.847] CloseHandle (hObject=0x310) returned 1 [0075.850] CloseHandle (hObject=0x334) returned 1 [0075.852] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0075.880] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0075.880] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=10125) returned 1 [0075.880] CloseHandle (hObject=0x334) returned 1 [0075.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0075.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0075.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0075.881] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0075.881] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0075.881] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0075.881] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0076.082] ReadFile (in: hFile=0x334, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x278d, lpOverlapped=0x0) returned 1 [0076.085] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x2790, lpOverlapped=0x0) returned 1 [0076.086] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0076.087] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0076.087] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0076.087] WriteFile (in: hFile=0x334, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x278d, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x278d, lpOverlapped=0x0) returned 1 [0076.087] FlushFileBuffers (hFile=0x334) returned 1 [0076.350] FlushFileBuffers (hFile=0x310) returned 1 [0076.354] CloseHandle (hObject=0x334) returned 1 [0076.355] CloseHandle (hObject=0x310) returned 1 [0076.355] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0076.479] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0076.479] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=12687) returned 1 [0076.479] CloseHandle (hObject=0x30c) returned 1 [0076.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0076.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0076.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0076.479] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0076.479] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0076.479] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0076.479] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0076.496] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x318f, lpOverlapped=0x0) returned 1 [0076.501] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x3190, lpOverlapped=0x0) returned 1 [0076.502] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0076.502] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0076.502] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0076.502] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x318f, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x318f, lpOverlapped=0x0) returned 1 [0076.502] FlushFileBuffers (hFile=0x30c) returned 1 [0076.509] FlushFileBuffers (hFile=0x33c) returned 1 [0076.519] CloseHandle (hObject=0x30c) returned 1 [0076.519] CloseHandle (hObject=0x33c) returned 1 [0076.520] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0076.548] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.548] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=65238) returned 1 [0076.548] CloseHandle (hObject=0x33c) returned 1 [0076.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0076.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0076.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0076.548] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0076.548] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0076.549] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0076.549] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0076.549] ReadFile (in: hFile=0x33c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xfed6, lpOverlapped=0x0) returned 1 [0076.551] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xfee0, lpOverlapped=0x0) returned 1 [0076.553] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0076.757] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0076.757] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0076.757] WriteFile (in: hFile=0x33c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xfed6, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xfed6, lpOverlapped=0x0) returned 1 [0076.758] FlushFileBuffers (hFile=0x33c) returned 1 [0077.530] FlushFileBuffers (hFile=0x30c) returned 1 [0077.531] CloseHandle (hObject=0x33c) returned 1 [0077.533] CloseHandle (hObject=0x30c) returned 1 [0077.535] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0077.865] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0077.866] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3546) returned 1 [0077.866] CloseHandle (hObject=0x338) returned 1 [0077.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0077.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0077.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0077.866] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0077.866] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0077.866] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0077.866] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0077.868] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xdda, lpOverlapped=0x0) returned 1 [0077.869] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xde0, lpOverlapped=0x0) returned 1 [0077.870] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0077.870] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0077.870] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0077.871] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xdda, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xdda, lpOverlapped=0x0) returned 1 [0077.871] FlushFileBuffers (hFile=0x338) returned 1 [0077.909] FlushFileBuffers (hFile=0x30c) returned 1 [0077.947] CloseHandle (hObject=0x338) returned 1 [0077.948] CloseHandle (hObject=0x30c) returned 1 [0077.948] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0077.975] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0077.981] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=19288) returned 1 [0077.981] CloseHandle (hObject=0x30c) returned 1 [0077.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0077.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0077.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0077.981] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0077.981] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0077.981] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0077.981] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0077.982] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x4b58, lpOverlapped=0x0) returned 1 [0077.987] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x4b60, lpOverlapped=0x0) returned 1 [0077.988] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0077.988] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0077.988] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0077.988] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4b58, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x4b58, lpOverlapped=0x0) returned 1 [0077.989] FlushFileBuffers (hFile=0x30c) returned 1 [0079.062] FlushFileBuffers (hFile=0x338) returned 1 [0079.065] CloseHandle (hObject=0x30c) returned 1 [0079.066] CloseHandle (hObject=0x338) returned 1 [0079.067] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0079.068] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0079.071] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=79296) returned 1 [0079.071] CloseHandle (hObject=0x338) returned 1 [0079.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0079.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0079.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.071] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0079.071] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0079.071] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0079.071] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0079.072] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x135c0, lpOverlapped=0x0) returned 1 [0079.075] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x135d0, lpOverlapped=0x0) returned 1 [0079.077] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0079.077] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0079.077] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0079.077] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x135c0, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x135c0, lpOverlapped=0x0) returned 1 [0079.077] FlushFileBuffers (hFile=0x338) returned 1 [0079.379] FlushFileBuffers (hFile=0x30c) returned 1 [0079.380] CloseHandle (hObject=0x338) returned 1 [0079.383] CloseHandle (hObject=0x30c) returned 1 [0079.385] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0079.386] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0079.387] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=4040) returned 1 [0079.387] CloseHandle (hObject=0x30c) returned 1 [0079.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0079.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0079.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.387] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0079.387] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0079.387] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0079.387] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0079.392] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xfc8, lpOverlapped=0x0) returned 1 [0079.394] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xfd0, lpOverlapped=0x0) returned 1 [0079.395] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0079.395] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0079.395] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0079.396] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xfc8, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xfc8, lpOverlapped=0x0) returned 1 [0079.396] FlushFileBuffers (hFile=0x30c) returned 1 [0079.399] FlushFileBuffers (hFile=0x338) returned 1 [0079.401] CloseHandle (hObject=0x30c) returned 1 [0079.402] CloseHandle (hObject=0x338) returned 1 [0079.403] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0079.404] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0079.404] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=82374) returned 1 [0079.404] CloseHandle (hObject=0x338) returned 1 [0079.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0079.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0079.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0079.404] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0079.404] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0079.404] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0079.404] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0079.404] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x141c6, lpOverlapped=0x0) returned 1 [0079.407] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x141d0, lpOverlapped=0x0) returned 1 [0079.409] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0079.409] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0079.409] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0079.409] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x141c6, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x141c6, lpOverlapped=0x0) returned 1 [0079.410] FlushFileBuffers (hFile=0x338) returned 1 [0080.089] FlushFileBuffers (hFile=0x30c) returned 1 [0080.091] CloseHandle (hObject=0x338) returned 1 [0080.093] CloseHandle (hObject=0x30c) returned 1 [0080.095] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0080.096] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0080.097] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3683) returned 1 [0080.097] CloseHandle (hObject=0x30c) returned 1 [0080.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0080.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0080.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0080.097] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0080.097] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.097] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.098] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0080.099] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xe63, lpOverlapped=0x0) returned 1 [0080.101] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xe70, lpOverlapped=0x0) returned 1 [0080.102] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0080.102] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.102] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.102] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe63, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xe63, lpOverlapped=0x0) returned 1 [0080.102] FlushFileBuffers (hFile=0x30c) returned 1 [0080.106] FlushFileBuffers (hFile=0x338) returned 1 [0080.107] CloseHandle (hObject=0x30c) returned 1 [0080.107] CloseHandle (hObject=0x338) returned 1 [0080.108] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0080.109] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0080.109] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=80738) returned 1 [0080.109] CloseHandle (hObject=0x338) returned 1 [0080.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0080.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0080.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0080.110] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0080.110] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.110] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.110] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0080.110] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x13b62, lpOverlapped=0x0) returned 1 [0080.112] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x13b70, lpOverlapped=0x0) returned 1 [0080.114] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0080.115] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.115] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.115] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13b62, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x13b62, lpOverlapped=0x0) returned 1 [0080.115] FlushFileBuffers (hFile=0x338) returned 1 [0080.549] FlushFileBuffers (hFile=0x30c) returned 1 [0080.551] CloseHandle (hObject=0x338) returned 1 [0080.553] CloseHandle (hObject=0x30c) returned 1 [0080.555] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0080.556] SetEvent (hEvent=0x2f0) returned 1 [0080.556] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0080.557] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=54456) returned 1 [0080.557] CloseHandle (hObject=0x30c) returned 1 [0080.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0080.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0080.558] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0080.558] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0080.558] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.558] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.558] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0080.559] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xd4b8, lpOverlapped=0x0) returned 1 [0080.561] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xd4c0, lpOverlapped=0x0) returned 1 [0080.563] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0080.563] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.563] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.563] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xd4b8, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xd4b8, lpOverlapped=0x0) returned 1 [0080.564] FlushFileBuffers (hFile=0x30c) returned 1 [0080.566] FlushFileBuffers (hFile=0x338) returned 1 [0080.567] CloseHandle (hObject=0x30c) returned 1 [0080.570] CloseHandle (hObject=0x338) returned 1 [0080.571] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0080.572] SetEvent (hEvent=0x2f0) returned 1 [0080.572] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0080.573] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=81482) returned 1 [0080.573] CloseHandle (hObject=0x338) returned 1 [0080.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0080.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0080.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0080.573] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0080.573] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.573] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0080.573] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0080.575] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x13e4a, lpOverlapped=0x0) returned 1 [0080.577] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x13e50, lpOverlapped=0x0) returned 1 [0080.579] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0080.579] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.579] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0080.579] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13e4a, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x13e4a, lpOverlapped=0x0) returned 1 [0080.580] FlushFileBuffers (hFile=0x338) returned 1 [0081.255] FlushFileBuffers (hFile=0x30c) returned 1 [0081.256] CloseHandle (hObject=0x338) returned 1 [0081.258] CloseHandle (hObject=0x30c) returned 1 [0081.260] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0081.261] SetEvent (hEvent=0x2f0) returned 1 [0081.261] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0081.262] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3865) returned 1 [0081.262] CloseHandle (hObject=0x30c) returned 1 [0081.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0081.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0081.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0081.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0081.262] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0081.262] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0081.262] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0081.264] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xf19, lpOverlapped=0x0) returned 1 [0081.265] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf20, lpOverlapped=0x0) returned 1 [0081.266] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0081.266] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0081.266] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0081.266] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf19, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xf19, lpOverlapped=0x0) returned 1 [0081.267] FlushFileBuffers (hFile=0x30c) returned 1 [0081.269] FlushFileBuffers (hFile=0x338) returned 1 [0081.274] CloseHandle (hObject=0x30c) returned 1 [0081.274] CloseHandle (hObject=0x338) returned 1 [0081.275] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0081.276] SetEvent (hEvent=0x2f0) returned 1 [0081.276] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0081.276] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=77680) returned 1 [0081.276] CloseHandle (hObject=0x338) returned 1 [0081.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0081.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0081.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0081.276] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0081.276] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0081.276] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0081.276] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0081.277] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x12f70, lpOverlapped=0x0) returned 1 [0081.279] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x12f80, lpOverlapped=0x0) returned 1 [0081.285] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0081.285] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0081.285] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0081.285] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12f70, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x12f70, lpOverlapped=0x0) returned 1 [0081.285] FlushFileBuffers (hFile=0x338) returned 1 [0081.619] FlushFileBuffers (hFile=0x30c) returned 1 [0082.629] CloseHandle (hObject=0x338) returned 1 [0082.631] CloseHandle (hObject=0x30c) returned 1 [0082.633] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0082.634] SetEvent (hEvent=0x2f0) returned 1 [0082.635] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0082.635] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3859) returned 1 [0082.635] CloseHandle (hObject=0x30c) returned 1 [0082.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0082.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0082.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0082.635] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0082.635] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0082.636] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0082.636] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x338 [0082.645] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xf13, lpOverlapped=0x0) returned 1 [0082.647] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf20, lpOverlapped=0x0) returned 1 [0082.648] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0082.648] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0082.648] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0082.648] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf13, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xf13, lpOverlapped=0x0) returned 1 [0082.648] FlushFileBuffers (hFile=0x30c) returned 1 [0082.931] FlushFileBuffers (hFile=0x338) returned 1 [0082.950] CloseHandle (hObject=0x30c) returned 1 [0082.951] CloseHandle (hObject=0x338) returned 1 [0082.952] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0082.952] SetEvent (hEvent=0x2f0) returned 1 [0082.953] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0082.953] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=76818) returned 1 [0082.953] CloseHandle (hObject=0x338) returned 1 [0082.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0082.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0082.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0082.953] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0082.953] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0082.953] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0082.953] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0082.953] ReadFile (in: hFile=0x338, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x12c12, lpOverlapped=0x0) returned 1 [0082.975] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x12c20, lpOverlapped=0x0) returned 1 [0082.977] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0082.977] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0082.977] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0082.977] WriteFile (in: hFile=0x338, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x12c12, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x12c12, lpOverlapped=0x0) returned 1 [0082.977] FlushFileBuffers (hFile=0x338) returned 1 [0083.557] FlushFileBuffers (hFile=0x30c) returned 1 [0083.583] CloseHandle (hObject=0x338) returned 1 [0083.585] CloseHandle (hObject=0x30c) returned 1 [0083.587] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0083.588] SetEvent (hEvent=0x2f0) returned 1 [0083.589] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0083.589] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=5827) returned 1 [0083.589] CloseHandle (hObject=0x30c) returned 1 [0083.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0083.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0083.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0083.589] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0083.590] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0083.590] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0083.590] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0083.594] ReadFile (in: hFile=0x30c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x16c3, lpOverlapped=0x0) returned 1 [0083.600] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x16d0, lpOverlapped=0x0) returned 1 [0083.601] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0083.601] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0083.601] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0083.601] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x16c3, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x16c3, lpOverlapped=0x0) returned 1 [0083.601] FlushFileBuffers (hFile=0x30c) returned 1 [0083.997] FlushFileBuffers (hFile=0x4c4) returned 1 [0083.999] CloseHandle (hObject=0x30c) returned 1 [0083.999] CloseHandle (hObject=0x4c4) returned 1 [0084.000] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0084.001] SetEvent (hEvent=0x2f0) returned 1 [0084.001] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0084.001] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=14168) returned 1 [0084.001] CloseHandle (hObject=0x4c4) returned 1 [0084.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0084.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0084.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0084.001] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0084.002] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.002] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.002] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x30c [0084.002] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x3758, lpOverlapped=0x0) returned 1 [0084.004] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x3760, lpOverlapped=0x0) returned 1 [0084.005] WriteFile (in: hFile=0x30c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0084.005] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.005] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.005] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x3758, lpOverlapped=0x0) returned 1 [0084.005] FlushFileBuffers (hFile=0x4c4) returned 1 [0084.475] FlushFileBuffers (hFile=0x30c) returned 1 [0084.476] CloseHandle (hObject=0x4c4) returned 1 [0084.476] CloseHandle (hObject=0x30c) returned 1 [0084.477] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0084.478] SetEvent (hEvent=0x2f0) returned 1 [0084.478] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0084.480] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=4015) returned 1 [0084.480] CloseHandle (hObject=0x4c4) returned 1 [0084.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0084.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0084.480] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0084.480] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0084.480] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.481] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.481] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0084.482] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xfaf, lpOverlapped=0x0) returned 1 [0084.484] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xfb0, lpOverlapped=0x0) returned 1 [0084.484] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0084.485] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.485] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.485] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xfaf, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xfaf, lpOverlapped=0x0) returned 1 [0084.485] FlushFileBuffers (hFile=0x4c4) returned 1 [0084.546] FlushFileBuffers (hFile=0x254) returned 1 [0084.547] CloseHandle (hObject=0x4c4) returned 1 [0084.548] CloseHandle (hObject=0x254) returned 1 [0084.548] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0084.549] SetEvent (hEvent=0x2f0) returned 1 [0084.549] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0084.549] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=80254) returned 1 [0084.549] CloseHandle (hObject=0x254) returned 1 [0084.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0084.549] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0084.550] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0084.550] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0084.550] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.550] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.550] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0084.550] ReadFile (in: hFile=0x254, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x1397e, lpOverlapped=0x0) returned 1 [0084.553] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x13980, lpOverlapped=0x0) returned 1 [0084.555] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0084.555] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.555] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.555] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x1397e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x1397e, lpOverlapped=0x0) returned 1 [0084.556] FlushFileBuffers (hFile=0x254) returned 1 [0084.692] FlushFileBuffers (hFile=0x4c4) returned 1 [0084.693] CloseHandle (hObject=0x254) returned 1 [0084.695] CloseHandle (hObject=0x4c4) returned 1 [0084.697] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0084.699] SetEvent (hEvent=0x2f0) returned 1 [0084.699] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0084.700] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=6309) returned 1 [0084.700] CloseHandle (hObject=0x4c4) returned 1 [0084.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0084.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0084.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0084.700] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0084.700] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.700] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0084.700] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0084.702] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x18a5, lpOverlapped=0x0) returned 1 [0084.704] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x18b0, lpOverlapped=0x0) returned 1 [0084.704] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0084.705] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.705] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0084.705] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x18a5, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x18a5, lpOverlapped=0x0) returned 1 [0084.705] FlushFileBuffers (hFile=0x4c4) returned 1 [0085.132] FlushFileBuffers (hFile=0x254) returned 1 [0085.133] CloseHandle (hObject=0x4c4) returned 1 [0085.133] CloseHandle (hObject=0x254) returned 1 [0085.134] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0085.135] SetEvent (hEvent=0x2f0) returned 1 [0085.135] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0085.135] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=14168) returned 1 [0085.135] CloseHandle (hObject=0x254) returned 1 [0085.135] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0085.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0085.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.136] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0085.136] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.136] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.136] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0085.136] ReadFile (in: hFile=0x254, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x3758, lpOverlapped=0x0) returned 1 [0085.138] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x3760, lpOverlapped=0x0) returned 1 [0085.139] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0085.139] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.139] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.139] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3758, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x3758, lpOverlapped=0x0) returned 1 [0085.139] FlushFileBuffers (hFile=0x254) returned 1 [0085.556] FlushFileBuffers (hFile=0x4c4) returned 1 [0085.557] CloseHandle (hObject=0x254) returned 1 [0085.558] CloseHandle (hObject=0x4c4) returned 1 [0085.559] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0085.560] SetEvent (hEvent=0x2f0) returned 1 [0085.560] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0085.560] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=18776) returned 1 [0085.560] CloseHandle (hObject=0x4c4) returned 1 [0085.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0085.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0085.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.560] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0085.560] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.561] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.561] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0085.561] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x4958, lpOverlapped=0x0) returned 1 [0085.563] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x4960, lpOverlapped=0x0) returned 1 [0085.564] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0085.564] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.564] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.564] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x4958, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x4958, lpOverlapped=0x0) returned 1 [0085.564] FlushFileBuffers (hFile=0x4c4) returned 1 [0085.773] FlushFileBuffers (hFile=0x254) returned 1 [0085.787] CloseHandle (hObject=0x4c4) returned 1 [0085.787] CloseHandle (hObject=0x254) returned 1 [0085.788] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0085.789] SetEvent (hEvent=0x2f0) returned 1 [0085.789] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0085.789] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=16118) returned 1 [0085.789] CloseHandle (hObject=0x254) returned 1 [0085.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0085.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0085.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.789] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0085.790] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.790] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.790] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0085.790] ReadFile (in: hFile=0x254, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x3ef6, lpOverlapped=0x0) returned 1 [0085.793] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x3f00, lpOverlapped=0x0) returned 1 [0085.794] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0085.795] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.795] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.795] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x3ef6, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x3ef6, lpOverlapped=0x0) returned 1 [0085.795] FlushFileBuffers (hFile=0x254) returned 1 [0085.832] FlushFileBuffers (hFile=0x4c4) returned 1 [0085.834] CloseHandle (hObject=0x254) returned 1 [0085.835] CloseHandle (hObject=0x4c4) returned 1 [0085.836] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0085.837] SetEvent (hEvent=0x2f0) returned 1 [0085.838] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0085.838] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=93314) returned 1 [0085.838] CloseHandle (hObject=0x4c4) returned 1 [0085.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0085.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0085.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0085.838] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0085.838] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.838] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0085.838] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x254 [0085.838] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x16c82, lpOverlapped=0x0) returned 1 [0085.841] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x16c90, lpOverlapped=0x0) returned 1 [0085.843] WriteFile (in: hFile=0x254, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0085.843] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.843] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.843] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x16c82, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x16c82, lpOverlapped=0x0) returned 1 [0085.844] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.025] FlushFileBuffers (hFile=0x254) returned 1 [0086.027] CloseHandle (hObject=0x4c4) returned 1 [0086.029] CloseHandle (hObject=0x254) returned 1 [0086.032] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0086.033] SetEvent (hEvent=0x2f0) returned 1 [0086.033] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0086.046] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=1150) returned 1 [0086.047] CloseHandle (hObject=0x334) returned 1 [0086.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0086.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0086.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.048] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.048] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.048] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.048] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0086.049] ReadFile (in: hFile=0x368, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x47e, lpOverlapped=0x0) returned 1 [0086.053] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x480, lpOverlapped=0x0) returned 1 [0086.054] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.054] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.054] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.054] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x47e, lpOverlapped=0x0) returned 1 [0086.054] FlushFileBuffers (hFile=0x368) returned 1 [0086.164] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.166] CloseHandle (hObject=0x368) returned 1 [0086.167] CloseHandle (hObject=0x4c4) returned 1 [0086.167] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0086.168] SetEvent (hEvent=0x2f0) returned 1 [0086.168] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.169] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=894) returned 1 [0086.169] CloseHandle (hObject=0x4c4) returned 1 [0086.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0086.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0086.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.169] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.169] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.169] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.169] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0086.170] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x37e, lpOverlapped=0x0) returned 1 [0086.171] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x380, lpOverlapped=0x0) returned 1 [0086.172] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.172] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.172] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.172] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.173] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.206] FlushFileBuffers (hFile=0x368) returned 1 [0086.211] CloseHandle (hObject=0x4c4) returned 1 [0086.211] CloseHandle (hObject=0x368) returned 1 [0086.212] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0086.213] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.213] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=894) returned 1 [0086.213] CloseHandle (hObject=0x368) returned 1 [0086.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0086.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0086.213] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.213] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.213] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.213] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.213] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0086.213] ReadFile (in: hFile=0x368, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x37e, lpOverlapped=0x0) returned 1 [0086.217] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x380, lpOverlapped=0x0) returned 1 [0086.218] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.218] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.218] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.218] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.219] FlushFileBuffers (hFile=0x368) returned 1 [0086.221] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.236] CloseHandle (hObject=0x368) returned 1 [0086.236] CloseHandle (hObject=0x4c4) returned 1 [0086.237] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0086.238] SetEvent (hEvent=0x2f0) returned 1 [0086.238] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.240] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=894) returned 1 [0086.240] CloseHandle (hObject=0x4c4) returned 1 [0086.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0086.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0086.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.240] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.241] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.241] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.241] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0086.241] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x37e, lpOverlapped=0x0) returned 1 [0086.242] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x380, lpOverlapped=0x0) returned 1 [0086.243] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.243] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.243] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.244] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x37e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x37e, lpOverlapped=0x0) returned 1 [0086.244] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.250] FlushFileBuffers (hFile=0x368) returned 1 [0086.254] CloseHandle (hObject=0x4c4) returned 1 [0086.254] CloseHandle (hObject=0x368) returned 1 [0086.254] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0086.256] SetEvent (hEvent=0x2f0) returned 1 [0086.256] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.256] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=36710) returned 1 [0086.256] CloseHandle (hObject=0x368) returned 1 [0086.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0086.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0086.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.257] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.257] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.257] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.257] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0086.257] ReadFile (in: hFile=0x368, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x8f66, lpOverlapped=0x0) returned 1 [0086.260] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x8f70, lpOverlapped=0x0) returned 1 [0086.261] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.261] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.262] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.262] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x8f66, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x8f66, lpOverlapped=0x0) returned 1 [0086.262] FlushFileBuffers (hFile=0x368) returned 1 [0086.273] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.280] CloseHandle (hObject=0x368) returned 1 [0086.281] CloseHandle (hObject=0x4c4) returned 1 [0086.282] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0086.283] SetEvent (hEvent=0x2f0) returned 1 [0086.284] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.284] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=1150) returned 1 [0086.284] CloseHandle (hObject=0x4c4) returned 1 [0086.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0086.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0086.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.284] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.284] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.284] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.284] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0086.284] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x47e, lpOverlapped=0x0) returned 1 [0086.295] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x480, lpOverlapped=0x0) returned 1 [0086.296] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.296] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.296] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.296] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x47e, lpOverlapped=0x0) returned 1 [0086.297] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.312] FlushFileBuffers (hFile=0x368) returned 1 [0086.313] CloseHandle (hObject=0x4c4) returned 1 [0086.313] CloseHandle (hObject=0x368) returned 1 [0086.314] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0086.315] SetEvent (hEvent=0x2f0) returned 1 [0086.315] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.315] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=1150) returned 1 [0086.315] CloseHandle (hObject=0x368) returned 1 [0086.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0086.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0086.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.315] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.315] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.315] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0086.316] ReadFile (in: hFile=0x368, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x47e, lpOverlapped=0x0) returned 1 [0086.317] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x480, lpOverlapped=0x0) returned 1 [0086.318] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0086.318] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.318] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.318] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x47e, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x47e, lpOverlapped=0x0) returned 1 [0086.319] FlushFileBuffers (hFile=0x368) returned 1 [0086.326] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.332] CloseHandle (hObject=0x368) returned 1 [0086.332] CloseHandle (hObject=0x4c4) returned 1 [0086.333] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0086.334] SetEvent (hEvent=0x2f0) returned 1 [0086.334] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.334] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=10134) returned 1 [0086.334] CloseHandle (hObject=0x4c4) returned 1 [0086.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0086.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0086.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.334] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.334] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.335] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.335] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x368 [0086.335] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x2796, lpOverlapped=0x0) returned 1 [0086.336] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x27a0, lpOverlapped=0x0) returned 1 [0086.337] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.337] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.338] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.338] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x2796, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x2796, lpOverlapped=0x0) returned 1 [0086.338] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.339] FlushFileBuffers (hFile=0x368) returned 1 [0086.341] CloseHandle (hObject=0x4c4) returned 1 [0086.341] CloseHandle (hObject=0x368) returned 1 [0086.342] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0086.343] SetEvent (hEvent=0x2f0) returned 1 [0086.343] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.344] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3628) returned 1 [0086.344] CloseHandle (hObject=0x368) returned 1 [0086.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0086.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0086.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0086.344] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0086.344] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.344] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0086.344] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0086.345] ReadFile (in: hFile=0x368, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xe2c, lpOverlapped=0x0) returned 1 [0086.346] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xe30, lpOverlapped=0x0) returned 1 [0086.347] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.347] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.347] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0086.347] WriteFile (in: hFile=0x368, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xe2c, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xe2c, lpOverlapped=0x0) returned 1 [0086.347] FlushFileBuffers (hFile=0x368) returned 1 [0086.839] FlushFileBuffers (hFile=0x4c4) returned 1 [0086.841] CloseHandle (hObject=0x368) returned 1 [0086.841] CloseHandle (hObject=0x4c4) returned 1 [0086.842] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0086.843] SetEvent (hEvent=0x2f0) returned 1 [0086.843] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.844] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=1901056) returned 1 [0086.844] CloseHandle (hObject=0x4c4) returned 1 [0086.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0086.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 1 [0086.844] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c4 [0086.845] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0086.845] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0086.845] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f827058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f827058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.849] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0086.849] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f867058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f867058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.852] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0086.852] ReadFile (in: hFile=0x4c4, lpBuffer=0x1f8a7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f8a7058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0086.864] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed0 | out: lpNewFilePointer=0x0) returned 1 [0086.864] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x1f81fec8, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec8*=0xc0112, lpOverlapped=0x0) returned 1 [0087.048] SetEndOfFile (hFile=0x4c4) returned 1 [0087.048] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0087.048] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f8e714a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e714a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0087.050] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0087.050] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f8e714a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e714a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0087.052] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0087.052] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f8e714a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e714a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0087.053] FlushFileBuffers (hFile=0x4c4) returned 1 [0087.772] CloseHandle (hObject=0x4c4) returned 1 [0088.275] SetEvent (hEvent=0x2f0) returned 1 [0088.278] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0088.278] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=1163264) returned 1 [0088.278] CloseHandle (hObject=0x4d4) returned 1 [0088.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0088.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0088.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0088.279] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0088.279] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0088.279] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0088.279] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4 [0088.279] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x110100, lpOverlapped=0x0) returned 1 [0088.506] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x110100, lpOverlapped=0x0) returned 1 [0088.526] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xbf00, lpOverlapped=0x0) returned 1 [0088.527] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xbf10, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xbf10, lpOverlapped=0x0) returned 1 [0088.528] WriteFile (in: hFile=0x4c4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0088.528] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0088.528] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0088.528] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x110102, lpOverlapped=0x0) returned 1 [0088.533] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xbefe, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xbefe, lpOverlapped=0x0) returned 1 [0088.533] FlushFileBuffers (hFile=0x4d4) returned 1 [0089.786] FlushFileBuffers (hFile=0x4c4) returned 1 [0089.789] CloseHandle (hObject=0x4d4) returned 1 [0089.806] CloseHandle (hObject=0x4c4) returned 1 [0089.949] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0090.080] SetEvent (hEvent=0x2f0) returned 1 [0090.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0090.081] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=872448) returned 1 [0090.081] CloseHandle (hObject=0x51c) returned 1 [0090.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0090.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0090.081] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.082] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0090.082] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.082] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.082] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0090.082] ReadFile (in: hFile=0x51c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0xd5000, lpOverlapped=0x0) returned 1 [0090.096] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xd5010, lpOverlapped=0x0) returned 1 [0090.111] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0090.111] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0090.111] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0090.111] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xd5000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0xd5000, lpOverlapped=0x0) returned 1 [0090.113] FlushFileBuffers (hFile=0x51c) returned 1 [0090.454] FlushFileBuffers (hFile=0x4d4) returned 1 [0090.458] CloseHandle (hObject=0x51c) returned 1 [0090.472] CloseHandle (hObject=0x4d4) returned 1 [0090.486] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0090.494] SetEvent (hEvent=0x2f0) returned 1 [0090.494] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0090.494] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=495616) returned 1 [0090.494] CloseHandle (hObject=0x4d4) returned 1 [0090.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0090.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0090.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.613] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0090.613] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.613] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.613] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0090.613] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x79000, lpOverlapped=0x0) returned 1 [0090.622] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x79010, lpOverlapped=0x0) returned 1 [0090.629] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0090.630] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0090.630] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0090.630] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x79000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x79000, lpOverlapped=0x0) returned 1 [0090.631] FlushFileBuffers (hFile=0x4d4) returned 1 [0090.788] FlushFileBuffers (hFile=0x51c) returned 1 [0090.790] CloseHandle (hObject=0x4d4) returned 1 [0090.798] CloseHandle (hObject=0x51c) returned 1 [0090.806] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0090.810] SetEvent (hEvent=0x2f0) returned 1 [0090.810] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0090.810] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=78152) returned 1 [0090.811] CloseHandle (hObject=0x51c) returned 1 [0090.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0090.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0090.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.811] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0090.811] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.811] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.811] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0090.811] ReadFile (in: hFile=0x51c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x13148, lpOverlapped=0x0) returned 1 [0090.814] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x13150, lpOverlapped=0x0) returned 1 [0090.815] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0090.816] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0090.816] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0090.816] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x13148, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x13148, lpOverlapped=0x0) returned 1 [0090.816] FlushFileBuffers (hFile=0x51c) returned 1 [0090.983] FlushFileBuffers (hFile=0x4d4) returned 1 [0090.984] CloseHandle (hObject=0x51c) returned 1 [0090.986] CloseHandle (hObject=0x4d4) returned 1 [0090.988] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0090.990] SetEvent (hEvent=0x2f0) returned 1 [0090.990] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0090.990] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=295248) returned 1 [0090.990] CloseHandle (hObject=0x4d4) returned 1 [0090.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0090.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0090.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0090.990] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0090.990] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.991] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0090.991] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0090.991] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x48150, lpOverlapped=0x0) returned 1 [0090.997] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x48160, lpOverlapped=0x0) returned 1 [0091.002] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0091.002] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.002] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.002] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x48150, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x48150, lpOverlapped=0x0) returned 1 [0091.003] FlushFileBuffers (hFile=0x4d4) returned 1 [0091.216] FlushFileBuffers (hFile=0x51c) returned 1 [0091.217] CloseHandle (hObject=0x4d4) returned 1 [0091.222] CloseHandle (hObject=0x51c) returned 1 [0091.227] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0091.231] SetEvent (hEvent=0x2f0) returned 1 [0091.231] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0091.231] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=96088) returned 1 [0091.231] CloseHandle (hObject=0x51c) returned 1 [0091.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0091.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0091.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.236] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0091.236] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.236] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.237] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0091.237] ReadFile (in: hFile=0x51c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x17758, lpOverlapped=0x0) returned 1 [0091.239] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x17760, lpOverlapped=0x0) returned 1 [0091.241] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0091.242] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.242] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.242] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x17758, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x17758, lpOverlapped=0x0) returned 1 [0091.242] FlushFileBuffers (hFile=0x51c) returned 1 [0091.352] FlushFileBuffers (hFile=0x4d4) returned 1 [0091.353] CloseHandle (hObject=0x51c) returned 1 [0091.356] CloseHandle (hObject=0x4d4) returned 1 [0091.358] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0091.359] SetEvent (hEvent=0x2f0) returned 1 [0091.359] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0091.360] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=144416) returned 1 [0091.360] CloseHandle (hObject=0x4d4) returned 1 [0091.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0091.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0091.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.360] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0091.360] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.360] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.360] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0091.360] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x23420, lpOverlapped=0x0) returned 1 [0091.364] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x23430, lpOverlapped=0x0) returned 1 [0091.366] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0091.367] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.367] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.367] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x23420, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x23420, lpOverlapped=0x0) returned 1 [0091.367] FlushFileBuffers (hFile=0x4d4) returned 1 [0091.495] FlushFileBuffers (hFile=0x51c) returned 1 [0091.499] CloseHandle (hObject=0x4d4) returned 1 [0091.502] CloseHandle (hObject=0x51c) returned 1 [0091.505] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0091.507] SetEvent (hEvent=0x2f0) returned 1 [0091.507] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0091.507] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=38898) returned 1 [0091.507] CloseHandle (hObject=0x51c) returned 1 [0091.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0091.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0091.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.507] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0091.507] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.507] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.508] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4 [0091.508] ReadFile (in: hFile=0x51c, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x97f2, lpOverlapped=0x0) returned 1 [0091.510] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x9800, lpOverlapped=0x0) returned 1 [0091.511] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0091.512] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.512] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.512] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x97f2, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x97f2, lpOverlapped=0x0) returned 1 [0091.512] FlushFileBuffers (hFile=0x51c) returned 1 [0091.557] FlushFileBuffers (hFile=0x4d4) returned 1 [0091.558] CloseHandle (hObject=0x51c) returned 1 [0091.559] CloseHandle (hObject=0x4d4) returned 1 [0091.560] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0091.561] SetEvent (hEvent=0x2f0) returned 1 [0091.562] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0091.562] GetFileSizeEx (in: hFile=0x4d4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=104072) returned 1 [0091.562] CloseHandle (hObject=0x4d4) returned 1 [0091.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0091.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0091.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0091.562] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d4 [0091.562] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.562] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0091.562] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x51c [0091.563] ReadFile (in: hFile=0x4d4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x19688, lpOverlapped=0x0) returned 1 [0091.568] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x19690, lpOverlapped=0x0) returned 1 [0091.570] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0091.570] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.570] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0091.570] WriteFile (in: hFile=0x4d4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x19688, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x19688, lpOverlapped=0x0) returned 1 [0091.571] FlushFileBuffers (hFile=0x4d4) returned 1 [0091.741] FlushFileBuffers (hFile=0x51c) returned 1 [0091.745] CloseHandle (hObject=0x4d4) returned 1 [0091.747] CloseHandle (hObject=0x51c) returned 1 [0091.750] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0091.751] SetEvent (hEvent=0x2f0) returned 1 [0091.751] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0091.752] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=2192672) returned 1 [0091.752] CloseHandle (hObject=0x51c) returned 1 [0091.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0091.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 1 [0091.752] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0091.752] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0091.752] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0091.752] ReadFile (in: hFile=0x51c, lpBuffer=0x1f827058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f827058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0091.758] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0091.758] ReadFile (in: hFile=0x51c, lpBuffer=0x1f867058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f867058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0091.761] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0091.761] ReadFile (in: hFile=0x51c, lpBuffer=0x1f8a7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f8a7058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0091.780] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed0 | out: lpNewFilePointer=0x0) returned 1 [0091.780] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x1f81fec8, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec8*=0xc0132, lpOverlapped=0x0) returned 1 [0091.858] SetEndOfFile (hFile=0x51c) returned 1 [0091.858] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0091.858] WriteFile (in: hFile=0x51c, lpBuffer=0x1f8e716a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e716a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0091.859] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0091.859] WriteFile (in: hFile=0x51c, lpBuffer=0x1f8e716a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e716a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0091.861] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0091.861] WriteFile (in: hFile=0x51c, lpBuffer=0x1f8e716a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e716a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0091.863] FlushFileBuffers (hFile=0x51c) returned 1 [0091.916] CloseHandle (hObject=0x51c) returned 1 [0092.063] SetEvent (hEvent=0x2f0) returned 1 [0092.064] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0092.064] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=5091790) returned 1 [0092.064] CloseHandle (hObject=0x51c) returned 1 [0092.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0092.064] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 1 [0092.065] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0092.065] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0092.065] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0092.065] ReadFile (in: hFile=0x51c, lpBuffer=0x1f827058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f827058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0092.068] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0092.069] ReadFile (in: hFile=0x51c, lpBuffer=0x1f867058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f867058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0092.092] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd60 | out: lpNewFilePointer=0x0) returned 1 [0092.092] ReadFile (in: hFile=0x51c, lpBuffer=0x1f8a7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x1f81fd6c, lpOverlapped=0x0 | out: lpBuffer=0x1f8a7058*, lpNumberOfBytesRead=0x1f81fd6c*=0x40000, lpOverlapped=0x0) returned 1 [0092.105] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed0 | out: lpNewFilePointer=0x0) returned 1 [0092.105] WriteFile (in: hFile=0x51c, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x1f81fec8, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec8*=0xc0132, lpOverlapped=0x0) returned 1 [0092.206] SetEndOfFile (hFile=0x51c) returned 1 [0092.206] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0092.206] WriteFile (in: hFile=0x51c, lpBuffer=0x1f8e716a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e716a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0092.208] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0092.208] WriteFile (in: hFile=0x51c, lpBuffer=0x1f8e716a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e716a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0092.210] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fd68 | out: lpNewFilePointer=0x0) returned 1 [0092.210] WriteFile (in: hFile=0x51c, lpBuffer=0x1f8e716a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x1f81fd74, lpOverlapped=0x0 | out: lpBuffer=0x1f8e716a*, lpNumberOfBytesWritten=0x1f81fd74*=0x40000, lpOverlapped=0x0) returned 1 [0092.211] FlushFileBuffers (hFile=0x51c) returned 1 [0092.218] CloseHandle (hObject=0x51c) returned 1 [0092.860] SetEvent (hEvent=0x2f0) returned 1 [0092.861] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.879] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=99744) returned 1 [0092.879] CloseHandle (hObject=0x254) returned 1 [0092.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0092.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0092.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.879] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.879] SetEvent (hEvent=0x2f0) returned 1 [0092.879] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.879] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=76632) returned 1 [0092.879] CloseHandle (hObject=0x254) returned 1 [0092.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0092.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0092.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.879] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.880] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.880] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45472) returned 1 [0092.880] CloseHandle (hObject=0x254) returned 1 [0092.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0092.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0092.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.880] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.880] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.880] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=75616) returned 1 [0092.880] CloseHandle (hObject=0x254) returned 1 [0092.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0092.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0092.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.881] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.881] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.881] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45472) returned 1 [0092.881] CloseHandle (hObject=0x254) returned 1 [0092.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0092.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0092.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.881] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.881] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.882] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=79200) returned 1 [0092.882] CloseHandle (hObject=0x254) returned 1 [0092.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0092.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0092.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.882] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.882] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.882] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45984) returned 1 [0092.882] CloseHandle (hObject=0x254) returned 1 [0092.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0092.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0092.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.882] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.883] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.883] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=80224) returned 1 [0092.883] CloseHandle (hObject=0x254) returned 1 [0092.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0092.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0092.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.883] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.883] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.883] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=46496) returned 1 [0092.883] CloseHandle (hObject=0x254) returned 1 [0092.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0092.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0092.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.884] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=74072) returned 1 [0092.884] CloseHandle (hObject=0x254) returned 1 [0092.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0092.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0092.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.884] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.885] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=74144) returned 1 [0092.885] CloseHandle (hObject=0x254) returned 1 [0092.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0092.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0092.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.885] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.885] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.885] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=44960) returned 1 [0092.885] CloseHandle (hObject=0x254) returned 1 [0092.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0092.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0092.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.885] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.886] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.886] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=77664) returned 1 [0092.886] CloseHandle (hObject=0x254) returned 1 [0092.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0092.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0092.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.886] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.886] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.887] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45984) returned 1 [0092.887] CloseHandle (hObject=0x254) returned 1 [0092.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0092.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0092.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.891] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.891] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.892] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=77664) returned 1 [0092.892] CloseHandle (hObject=0x254) returned 1 [0092.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0092.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0092.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.892] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.892] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.892] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=75104) returned 1 [0092.892] CloseHandle (hObject=0x254) returned 1 [0092.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0092.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0092.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.893] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.893] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.893] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=76640) returned 1 [0092.893] CloseHandle (hObject=0x254) returned 1 [0092.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0092.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0092.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.893] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.893] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.893] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45472) returned 1 [0092.893] CloseHandle (hObject=0x254) returned 1 [0092.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0092.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0092.894] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.894] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.894] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.896] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3695719) returned 1 [0092.897] CloseHandle (hObject=0x254) returned 1 [0092.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0092.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0 [0092.897] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0092.897] SetEvent (hEvent=0x2f0) returned 1 [0092.897] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0092.898] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=3878410) returned 1 [0092.898] CloseHandle (hObject=0x254) returned 1 [0092.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0092.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0 [0092.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0092.899] SetEvent (hEvent=0x2f0) returned 1 [0092.899] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.901] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=1985867) returned 1 [0092.901] CloseHandle (hObject=0x338) returned 1 [0092.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0092.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0 [0092.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0092.901] SetEvent (hEvent=0x2f0) returned 1 [0092.902] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.903] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=2373000) returned 1 [0092.903] CloseHandle (hObject=0x338) returned 1 [0092.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0092.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0 [0092.903] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0092.903] SetEvent (hEvent=0x2f0) returned 1 [0092.904] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.905] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=174959) returned 1 [0092.905] CloseHandle (hObject=0x338) returned 1 [0092.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0092.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0092.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.905] SetEvent (hEvent=0x2f0) returned 1 [0092.905] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0092.908] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=177414) returned 1 [0092.908] CloseHandle (hObject=0x37c) returned 1 [0092.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0092.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0092.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.908] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.908] SetEvent (hEvent=0x2f0) returned 1 [0092.908] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.911] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=143754) returned 1 [0092.911] CloseHandle (hObject=0x338) returned 1 [0092.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0092.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0092.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.912] SetEvent (hEvent=0x2f0) returned 1 [0092.912] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.913] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=145419) returned 1 [0092.913] CloseHandle (hObject=0x338) returned 1 [0092.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0092.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0092.913] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.913] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.913] SetEvent (hEvent=0x2f0) returned 1 [0092.914] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.914] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=162331) returned 1 [0092.914] CloseHandle (hObject=0x338) returned 1 [0092.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0092.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0092.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.914] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.914] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.915] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=164347) returned 1 [0092.915] CloseHandle (hObject=0x338) returned 1 [0092.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0092.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0092.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.915] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.915] SetEvent (hEvent=0x2f0) returned 1 [0092.915] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.916] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=154427) returned 1 [0092.916] CloseHandle (hObject=0x338) returned 1 [0092.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0092.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0092.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.916] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.916] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0092.916] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=156245) returned 1 [0092.916] CloseHandle (hObject=0x338) returned 1 [0092.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0092.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0092.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.916] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.917] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.918] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=44859) returned 1 [0092.918] CloseHandle (hObject=0x380) returned 1 [0092.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0092.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0092.918] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.918] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.918] SetEvent (hEvent=0x2f0) returned 1 [0092.918] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.918] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=85862) returned 1 [0092.918] CloseHandle (hObject=0x380) returned 1 [0092.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0092.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0092.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.919] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.919] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.919] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=86178) returned 1 [0092.919] CloseHandle (hObject=0x380) returned 1 [0092.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0092.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0092.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.919] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.919] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.920] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=49091) returned 1 [0092.920] CloseHandle (hObject=0x380) returned 1 [0092.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0092.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0092.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.920] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.920] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.920] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=79200) returned 1 [0092.920] CloseHandle (hObject=0x380) returned 1 [0092.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0092.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0092.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.920] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.921] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.921] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=79192) returned 1 [0092.921] CloseHandle (hObject=0x380) returned 1 [0092.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0092.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0092.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.921] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.921] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.921] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45984) returned 1 [0092.921] CloseHandle (hObject=0x380) returned 1 [0092.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0092.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0092.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.922] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.922] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.922] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=76640) returned 1 [0092.922] CloseHandle (hObject=0x380) returned 1 [0092.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0092.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0092.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.922] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.922] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.922] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=78688) returned 1 [0092.922] CloseHandle (hObject=0x380) returned 1 [0092.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0092.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0092.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.923] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.923] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.923] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45976) returned 1 [0092.923] CloseHandle (hObject=0x380) returned 1 [0092.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0092.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0092.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.923] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.923] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.924] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=77144) returned 1 [0092.924] CloseHandle (hObject=0x380) returned 1 [0092.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0092.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0092.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.924] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.924] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.924] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45472) returned 1 [0092.924] CloseHandle (hObject=0x380) returned 1 [0092.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0092.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0092.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.924] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.925] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.925] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=67424) returned 1 [0092.925] CloseHandle (hObject=0x380) returned 1 [0092.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0092.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0092.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.925] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.925] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.925] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=42904) returned 1 [0092.925] CloseHandle (hObject=0x380) returned 1 [0092.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0092.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0092.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.925] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.926] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.926] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=66912) returned 1 [0092.926] CloseHandle (hObject=0x380) returned 1 [0092.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0092.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0092.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.926] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.926] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.926] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=42912) returned 1 [0092.926] CloseHandle (hObject=0x380) returned 1 [0092.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0092.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0092.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.927] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.927] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.927] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=75616) returned 1 [0092.927] CloseHandle (hObject=0x380) returned 1 [0092.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0092.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0092.927] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.927] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.927] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.928] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=75608) returned 1 [0092.928] CloseHandle (hObject=0x380) returned 1 [0092.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0092.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0092.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.928] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.928] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.928] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=811936) returned 1 [0092.928] CloseHandle (hObject=0x380) returned 1 [0092.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0092.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0092.928] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\memtest.exe.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.928] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.929] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.929] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=75616) returned 1 [0092.929] CloseHandle (hObject=0x380) returned 1 [0092.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0092.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0092.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.929] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.929] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.929] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45472) returned 1 [0092.929] CloseHandle (hObject=0x380) returned 1 [0092.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0092.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0092.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.929] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.930] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.930] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=78176) returned 1 [0092.930] CloseHandle (hObject=0x380) returned 1 [0092.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0092.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0092.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.930] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.930] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.930] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45472) returned 1 [0092.930] CloseHandle (hObject=0x380) returned 1 [0092.930] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0092.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0092.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.931] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.931] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.931] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=77656) returned 1 [0092.931] CloseHandle (hObject=0x380) returned 1 [0092.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0092.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0092.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.931] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.931] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.932] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=45984) returned 1 [0092.932] CloseHandle (hObject=0x380) returned 1 [0092.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0092.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0092.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0092.932] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0092.932] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0092.932] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=76640) returned 1 [0092.932] CloseHandle (hObject=0x380) returned 1 [0092.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0092.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0093.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.024] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0093.057] SetEvent (hEvent=0x2f0) returned 1 [0093.058] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0093.058] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=8192) returned 1 [0093.058] CloseHandle (hObject=0x2b4) returned 1 [0093.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0093.058] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0093.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x26 [0093.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootsect.bak.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.058] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0093.058] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.058] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.058] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\bootsect.bak.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x2b8 [0093.059] ReadFile (in: hFile=0x2b4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x2000, lpOverlapped=0x0) returned 1 [0093.060] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x2010, lpOverlapped=0x0) returned 1 [0093.061] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0xf2, lpOverlapped=0x0) returned 1 [0093.061] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.061] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.061] WriteFile (in: hFile=0x2b4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x2000, lpOverlapped=0x0) returned 1 [0093.061] FlushFileBuffers (hFile=0x2b4) returned 1 [0093.186] FlushFileBuffers (hFile=0x2b8) returned 1 [0093.191] CloseHandle (hObject=0x2b4) returned 1 [0093.192] CloseHandle (hObject=0x2b8) returned 1 [0093.193] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0093.194] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-2275].[checkcheck07@qq.com].Adame", dwFileAttributes=0x27) returned 1 [0093.194] SetEvent (hEvent=0x2f0) returned 1 [0093.194] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0093.195] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=69632) returned 1 [0093.195] CloseHandle (hObject=0x2b8) returned 1 [0093.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0093.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0093.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.196] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0093.196] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.196] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.196] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2b4 [0093.196] ReadFile (in: hFile=0x2b8, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x11000, lpOverlapped=0x0) returned 1 [0093.202] WriteFile (in: hFile=0x2b4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.204] WriteFile (in: hFile=0x2b4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0093.204] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.204] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.204] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.204] FlushFileBuffers (hFile=0x2b8) returned 1 [0093.208] FlushFileBuffers (hFile=0x2b4) returned 1 [0093.211] CloseHandle (hObject=0x2b8) returned 1 [0093.212] CloseHandle (hObject=0x2b4) returned 1 [0093.214] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0093.216] SetEvent (hEvent=0x2f0) returned 1 [0093.216] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0093.216] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=69632) returned 1 [0093.216] CloseHandle (hObject=0x2b4) returned 1 [0093.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0093.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0093.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.216] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0093.216] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.216] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.216] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2b8 [0093.217] ReadFile (in: hFile=0x2b4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x11000, lpOverlapped=0x0) returned 1 [0093.232] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.235] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x102, lpOverlapped=0x0) returned 1 [0093.238] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.238] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.238] WriteFile (in: hFile=0x2b4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.238] FlushFileBuffers (hFile=0x2b4) returned 1 [0093.270] FlushFileBuffers (hFile=0x2b8) returned 1 [0093.273] CloseHandle (hObject=0x2b4) returned 1 [0093.274] CloseHandle (hObject=0x2b8) returned 1 [0093.275] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0093.278] SetEvent (hEvent=0x2f0) returned 1 [0093.278] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0093.279] GetFileSizeEx (in: hFile=0x2b8, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=69632) returned 1 [0093.279] CloseHandle (hObject=0x2b8) returned 1 [0093.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0093.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0093.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.279] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b8 [0093.279] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.279] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.279] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2b4 [0093.280] ReadFile (in: hFile=0x2b8, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x11000, lpOverlapped=0x0) returned 1 [0093.282] WriteFile (in: hFile=0x2b4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.284] WriteFile (in: hFile=0x2b4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x132, lpOverlapped=0x0) returned 1 [0093.284] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.284] SetFilePointerEx (in: hFile=0x2b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.284] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.285] FlushFileBuffers (hFile=0x2b8) returned 1 [0093.294] FlushFileBuffers (hFile=0x2b4) returned 1 [0093.300] CloseHandle (hObject=0x2b8) returned 1 [0093.302] CloseHandle (hObject=0x2b4) returned 1 [0093.304] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0093.305] SetEvent (hEvent=0x2f0) returned 1 [0093.305] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0093.306] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=1052672) returned 1 [0093.306] CloseHandle (hObject=0x2b4) returned 1 [0093.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0093.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0093.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.307] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0093.307] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.307] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.307] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2b8 [0093.307] ReadFile (in: hFile=0x2b4, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x101000, lpOverlapped=0x0) returned 1 [0093.332] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x101010, lpOverlapped=0x0) returned 1 [0093.410] WriteFile (in: hFile=0x2b8, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x162, lpOverlapped=0x0) returned 1 [0093.410] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.410] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.410] WriteFile (in: hFile=0x2b4, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x101000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x101000, lpOverlapped=0x0) returned 1 [0093.415] FlushFileBuffers (hFile=0x2b4) returned 1 [0093.422] FlushFileBuffers (hFile=0x2b8) returned 1 [0093.431] CloseHandle (hObject=0x2b4) returned 1 [0093.447] CloseHandle (hObject=0x2b8) returned 1 [0093.516] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0093.554] SetEvent (hEvent=0x2f0) returned 1 [0093.555] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0093.555] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=69632) returned 1 [0093.555] CloseHandle (hObject=0x310) returned 1 [0093.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0093.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0093.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.556] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0093.556] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.556] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.556] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x384 [0093.556] ReadFile (in: hFile=0x310, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x11000, lpOverlapped=0x0) returned 1 [0093.559] WriteFile (in: hFile=0x384, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.560] WriteFile (in: hFile=0x384, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x142, lpOverlapped=0x0) returned 1 [0093.561] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.561] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0093.561] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x11000, lpOverlapped=0x0) returned 1 [0093.561] FlushFileBuffers (hFile=0x310) returned 1 [0093.734] FlushFileBuffers (hFile=0x384) returned 1 [0093.735] CloseHandle (hObject=0x310) returned 1 [0093.737] CloseHandle (hObject=0x384) returned 1 [0093.739] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0093.740] SetEvent (hEvent=0x2f0) returned 1 [0093.740] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0093.740] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x1f81ff10 | out: lpFileSize=0x1f81ff10*=69632) returned 1 [0093.740] CloseHandle (hObject=0x384) returned 1 [0093.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0093.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0093.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0093.994] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0093.994] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.994] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fed8 | out: lpNewFilePointer=0x0) returned 1 [0093.994] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0093.995] ReadFile (in: hFile=0x384, lpBuffer=0x1f827020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1f81feec, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesRead=0x1f81feec*=0x11000, lpOverlapped=0x0) returned 1 [0093.998] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x11010, lpOverlapped=0x0) returned 1 [0093.999] WriteFile (in: hFile=0x310, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x1f81fec4, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fec4*=0x142, lpOverlapped=0x0) returned 1 [0094.000] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0094.000] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1f81fc38 | out: lpNewFilePointer=0x0) returned 1 [0094.000] WriteFile (in: hFile=0x384, lpBuffer=0x1f827020*, nNumberOfBytesToWrite=0x11000, lpNumberOfBytesWritten=0x1f81fc44, lpOverlapped=0x0 | out: lpBuffer=0x1f827020*, lpNumberOfBytesWritten=0x1f81fc44*=0x11000, lpOverlapped=0x0) returned 1 [0094.000] FlushFileBuffers (hFile=0x384) Thread: id = 18 os_tid = 0x714 [0064.392] GetCurrentThreadId () returned 0x714 [0064.402] GetProcessHeap () returned 0x580000 [0064.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x38) returned 0x59b1e8 [0064.406] GetProcessHeap () returned 0x580000 [0064.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x590f48 [0064.411] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x340 [0064.411] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x344 [0064.411] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x32c [0064.411] GetProcessHeap () returned 0x580000 [0064.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x6512a0 [0064.416] GetProcessHeap () returned 0x580000 [0064.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x5a8250 [0064.421] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0064.421] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0064.421] Wow64DisableWow64FsRedirection (in: OldValue=0x1fb9ff6c | out: OldValue=0x1fb9ff6c*=0x0) returned 1 [0064.421] GetProcessHeap () returned 0x580000 [0064.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a8250 | out: hHeap=0x580000) returned 1 [0064.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x1fb9ff70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0064.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x4048ba, lpParameter=0x1fb9ff70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0064.422] GetProcessHeap () returned 0x580000 [0064.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x6612a8 [0064.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x59ac68 [0064.998] GetProcessHeap () returned 0x580000 [0065.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0065.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x59b068 [0065.003] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0065.003] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x425f869f, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x425f869f, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Logs", cAlternateFileName="")) returned 1 [0065.013] GetProcessHeap () returned 0x580000 [0065.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0065.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x425f869f, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x42ec37cf, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59b128 [0065.018] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x425f869f, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x42ec37cf, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.018] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x425c9973, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x425c9973, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x42ec37cf, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="DOWNLE~1.ADA")) returned 1 [0065.260] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x425f869f, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x425f869f, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x42e944d1, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="OOBE_2~1.ADA")) returned 1 [0065.659] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0065.670] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0065.670] FindClose (in: hFindFile=0x59b128 | out: hFindFile=0x59b128) returned 1 [0065.670] GetProcessHeap () returned 0x580000 [0065.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0065.671] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0065.682] GetProcessHeap () returned 0x580000 [0065.687] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0065.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x438a363c, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x59b128 [0065.725] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x438a363c, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.725] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43173a5e, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x43173a5e, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x436d07be, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="GETCUR~1.ADA")) returned 1 [0065.734] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0065.743] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0065.753] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438a363c, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x438a363c, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x438a363c, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="PARTNE~1.ADA")) returned 1 [0065.761] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0066.110] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0066.119] FindNextFileW (in: hFindFile=0x59b128, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0066.120] FindClose (in: hFindFile=0x59b128 | out: hFindFile=0x59b128) returned 1 [0066.120] GetProcessHeap () returned 0x580000 [0066.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0066.120] FindNextFileW (in: hFindFile=0x59b068, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0066.120] FindClose (in: hFindFile=0x59b068 | out: hFindFile=0x59b068) returned 1 [0066.120] GetProcessHeap () returned 0x580000 [0066.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0066.121] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0066.130] GetProcessHeap () returned 0x580000 [0066.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0066.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0066.135] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0066.135] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0066.375] GetProcessHeap () returned 0x580000 [0066.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0066.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x43ec0f63, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4e8 [0066.380] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x43ec0f63, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.380] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0066.389] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43ec0f63, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x43ec0f63, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x43ec0f63, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="DESKTO~1.ADA")) returned 1 [0066.398] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43ec0f63, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x43ec0f63, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x43ec0f63, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="DESKTO~1.ADA")) returned 0 [0066.398] FindClose (in: hFindFile=0x64c4e8 | out: hFindFile=0x64c4e8) returned 1 [0066.399] GetProcessHeap () returned 0x580000 [0066.399] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0066.399] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0066.688] GetProcessHeap () returned 0x580000 [0066.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0066.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x441bf176, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca68 [0066.701] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x441db90b, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.701] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441bf176, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x441bf176, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x441db90b, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="DESKTO~1.ADA")) returned 1 [0066.712] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x441bf176, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x441bf176, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x441db90b, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="DESKTO~1.ADA")) returned 0 [0066.712] FindClose (in: hFindFile=0x64ca68 | out: hFindFile=0x64ca68) returned 1 [0066.712] GetProcessHeap () returned 0x580000 [0066.712] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0066.712] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0066.712] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0066.712] GetProcessHeap () returned 0x580000 [0066.712] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0066.712] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0066.723] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0067.043] GetProcessHeap () returned 0x580000 [0067.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0067.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c8e8 [0067.098] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0067.099] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1025", cAlternateFileName="")) returned 1 [0067.108] GetProcessHeap () returned 0x580000 [0067.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0067.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x445ae2d5, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c9a8 [0067.112] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x445ae2d5, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.112] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x444c5d6e, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x444c5d6e, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x4455e728, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="EULART~1.ADA")) returned 1 [0067.121] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0067.130] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4455e728, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x4455e728, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x4455e728, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="LOCALI~1.ADA")) returned 1 [0067.358] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0067.369] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x445ae2d5, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x445ae2d5, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x445ae2d5, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="SETUPR~1.ADA")) returned 1 [0067.449] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x445ae2d5, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x445ae2d5, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x445ae2d5, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="SETUPR~1.ADA")) returned 0 [0067.450] FindClose (in: hFindFile=0x64c9a8 | out: hFindFile=0x64c9a8) returned 1 [0067.450] GetProcessHeap () returned 0x580000 [0067.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0067.450] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1028", cAlternateFileName="")) returned 1 [0067.458] GetProcessHeap () returned 0x580000 [0067.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0067.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x448a5e1b, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c9e8 [0067.840] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x448a5e1b, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.841] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0067.850] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448a5e1b, ftCreationTime.dwHighDateTime=0x1d5819a, ftLastAccessTime.dwLowDateTime=0x448a5e1b, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x448a5e1b, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-2275].[checkcheck07@qq.com].Adame", cAlternateFileName="EULART~1.ADA")) returned 1 [0067.860] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0067.869] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0067.878] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0067.878] FindClose (in: hFindFile=0x64c9e8 | out: hFindFile=0x64c9e8) returned 1 [0067.892] GetProcessHeap () returned 0x580000 [0067.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0067.892] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1029", cAlternateFileName="")) returned 1 [0067.901] GetProcessHeap () returned 0x580000 [0067.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0067.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0067.906] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.906] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0067.915] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0067.924] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0068.167] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0068.167] FindClose (in: hFindFile=0x64c828 | out: hFindFile=0x64c828) returned 1 [0068.167] GetProcessHeap () returned 0x580000 [0068.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0068.511] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1030", cAlternateFileName="")) returned 1 [0068.520] GetProcessHeap () returned 0x580000 [0068.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0068.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0068.526] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.526] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0068.536] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0068.545] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0068.554] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0068.554] FindClose (in: hFindFile=0x64c7a8 | out: hFindFile=0x64c7a8) returned 1 [0068.554] GetProcessHeap () returned 0x580000 [0068.554] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0068.554] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1031", cAlternateFileName="")) returned 1 [0068.713] GetProcessHeap () returned 0x580000 [0068.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0068.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c628 [0068.718] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.718] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0068.727] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0068.736] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0069.024] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0069.025] FindClose (in: hFindFile=0x64c628 | out: hFindFile=0x64c628) returned 1 [0069.025] GetProcessHeap () returned 0x580000 [0069.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0069.025] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1032", cAlternateFileName="")) returned 1 [0069.033] GetProcessHeap () returned 0x580000 [0069.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0069.038] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6e8 [0069.038] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.038] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0069.049] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0069.331] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0069.340] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0069.341] FindClose (in: hFindFile=0x64c6e8 | out: hFindFile=0x64c6e8) returned 1 [0069.341] GetProcessHeap () returned 0x580000 [0069.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0069.341] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1033", cAlternateFileName="")) returned 1 [0069.382] GetProcessHeap () returned 0x580000 [0069.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0069.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5e8 [0069.387] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.387] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0069.396] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0069.593] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0069.602] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0069.602] FindClose (in: hFindFile=0x64c5e8 | out: hFindFile=0x64c5e8) returned 1 [0069.602] GetProcessHeap () returned 0x580000 [0069.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0069.602] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1035", cAlternateFileName="")) returned 1 [0069.610] GetProcessHeap () returned 0x580000 [0069.615] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0069.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0069.615] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0069.615] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0069.767] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0069.777] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0069.817] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0069.817] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0069.821] GetProcessHeap () returned 0x580000 [0069.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0069.821] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1036", cAlternateFileName="")) returned 1 [0069.829] GetProcessHeap () returned 0x580000 [0069.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0069.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0070.204] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.204] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0070.356] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0070.364] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0070.373] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0070.373] FindClose (in: hFindFile=0x64c428 | out: hFindFile=0x64c428) returned 1 [0070.373] GetProcessHeap () returned 0x580000 [0070.373] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0070.374] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1037", cAlternateFileName="")) returned 1 [0070.382] GetProcessHeap () returned 0x580000 [0070.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0070.637] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0070.637] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.638] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0070.664] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0070.674] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0070.688] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0070.689] FindClose (in: hFindFile=0x64c7a8 | out: hFindFile=0x64c7a8) returned 1 [0070.689] GetProcessHeap () returned 0x580000 [0070.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0070.689] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1038", cAlternateFileName="")) returned 1 [0070.699] GetProcessHeap () returned 0x580000 [0070.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0071.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0071.177] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.177] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0071.207] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0071.323] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0071.333] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0071.333] GetProcessHeap () returned 0x580000 [0071.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0071.333] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1040", cAlternateFileName="")) returned 1 [0071.531] GetProcessHeap () returned 0x580000 [0071.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0071.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c9e8 [0071.577] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.577] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0071.731] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0071.740] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0071.749] FindNextFileW (in: hFindFile=0x64c9e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0071.749] FindClose (in: hFindFile=0x64c9e8 | out: hFindFile=0x64c9e8) returned 1 [0071.749] GetProcessHeap () returned 0x580000 [0071.749] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0071.749] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1041", cAlternateFileName="")) returned 1 [0071.758] GetProcessHeap () returned 0x580000 [0071.763] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0072.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0072.328] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.329] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.337] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.347] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.355] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0072.355] GetProcessHeap () returned 0x580000 [0072.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0072.355] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1042", cAlternateFileName="")) returned 1 [0072.581] GetProcessHeap () returned 0x580000 [0072.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0072.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c968 [0072.586] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.586] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0072.595] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0072.604] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0072.839] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0072.839] FindClose (in: hFindFile=0x64c968 | out: hFindFile=0x64c968) returned 1 [0072.840] GetProcessHeap () returned 0x580000 [0072.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0073.062] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1043", cAlternateFileName="")) returned 1 [0073.074] GetProcessHeap () returned 0x580000 [0073.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0073.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0073.119] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.119] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0073.128] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0073.137] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0073.560] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0073.560] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0073.560] GetProcessHeap () returned 0x580000 [0073.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0073.561] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1044", cAlternateFileName="")) returned 1 [0073.570] GetProcessHeap () returned 0x580000 [0073.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0073.574] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0073.591] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.591] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0073.600] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0073.942] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0073.953] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0073.953] FindClose (in: hFindFile=0x64c428 | out: hFindFile=0x64c428) returned 1 [0073.953] GetProcessHeap () returned 0x580000 [0073.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0074.282] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1045", cAlternateFileName="")) returned 1 [0074.291] GetProcessHeap () returned 0x580000 [0074.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0074.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca68 [0074.297] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.297] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0074.306] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0074.315] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0074.324] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0074.324] FindClose (in: hFindFile=0x64ca68 | out: hFindFile=0x64ca68) returned 1 [0074.324] GetProcessHeap () returned 0x580000 [0074.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0074.324] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1046", cAlternateFileName="")) returned 1 [0074.489] GetProcessHeap () returned 0x580000 [0074.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0074.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0074.494] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.494] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0074.504] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0074.513] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0074.522] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0074.522] FindClose (in: hFindFile=0x64c768 | out: hFindFile=0x64c768) returned 1 [0074.523] GetProcessHeap () returned 0x580000 [0074.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0074.523] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1049", cAlternateFileName="")) returned 1 [0074.674] GetProcessHeap () returned 0x580000 [0074.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0074.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0074.679] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.679] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0074.768] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0074.778] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0074.846] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0074.846] FindClose (in: hFindFile=0x64c6a8 | out: hFindFile=0x64c6a8) returned 1 [0074.847] GetProcessHeap () returned 0x580000 [0074.847] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0074.847] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1053", cAlternateFileName="")) returned 1 [0074.856] GetProcessHeap () returned 0x580000 [0074.861] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0075.121] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7e8 [0075.123] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.123] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0075.132] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0075.143] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0075.153] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0075.153] FindClose (in: hFindFile=0x64c7e8 | out: hFindFile=0x64c7e8) returned 1 [0075.153] GetProcessHeap () returned 0x580000 [0075.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0075.153] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="1055", cAlternateFileName="")) returned 1 [0075.361] GetProcessHeap () returned 0x580000 [0075.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0075.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c3e8 [0075.366] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.366] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0075.375] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0075.384] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0075.846] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0075.881] FindClose (in: hFindFile=0x64c3e8 | out: hFindFile=0x64c3e8) returned 1 [0075.881] GetProcessHeap () returned 0x580000 [0075.881] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0075.881] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="2052", cAlternateFileName="")) returned 1 [0075.890] GetProcessHeap () returned 0x580000 [0075.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0075.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c928 [0075.894] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.894] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0075.903] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0075.912] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0076.166] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0076.167] FindClose (in: hFindFile=0x64c928 | out: hFindFile=0x64c928) returned 1 [0076.170] GetProcessHeap () returned 0x580000 [0076.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0076.170] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="2070", cAlternateFileName="")) returned 1 [0076.179] GetProcessHeap () returned 0x580000 [0076.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0076.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4e8 [0076.184] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.184] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0076.192] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0076.201] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0076.503] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0076.503] FindClose (in: hFindFile=0x64c4e8 | out: hFindFile=0x64c4e8) returned 1 [0076.503] GetProcessHeap () returned 0x580000 [0076.504] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0076.504] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="3076", cAlternateFileName="")) returned 1 [0076.514] GetProcessHeap () returned 0x580000 [0076.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0076.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c968 [0076.553] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.553] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0076.562] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0076.805] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0076.813] FindNextFileW (in: hFindFile=0x64c968, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0076.813] FindClose (in: hFindFile=0x64c968 | out: hFindFile=0x64c968) returned 1 [0076.813] GetProcessHeap () returned 0x580000 [0076.813] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0076.813] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="3082", cAlternateFileName="")) returned 1 [0076.822] GetProcessHeap () returned 0x580000 [0076.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0076.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c628 [0076.827] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.827] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0077.137] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0077.145] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0077.261] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0077.262] FindClose (in: hFindFile=0x64c628 | out: hFindFile=0x64c628) returned 1 [0077.264] GetProcessHeap () returned 0x580000 [0077.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0077.266] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Client", cAlternateFileName="")) returned 1 [0077.278] GetProcessHeap () returned 0x580000 [0077.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff90070 [0077.642] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5e8 [0077.643] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.643] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0077.878] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0077.887] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0077.887] FindClose (in: hFindFile=0x64c5e8 | out: hFindFile=0x64c5e8) returned 1 [0077.887] GetProcessHeap () returned 0x580000 [0077.887] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff90070 | out: hHeap=0x580000) returned 1 [0077.887] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0077.896] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0077.904] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Extended", cAlternateFileName="")) returned 1 [0078.245] GetProcessHeap () returned 0x580000 [0078.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0078.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c528 [0078.249] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.249] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0078.258] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0078.266] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0078.267] FindClose (in: hFindFile=0x64c528 | out: hFindFile=0x64c528) returned 1 [0078.267] GetProcessHeap () returned 0x580000 [0078.267] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0078.267] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Graphics", cAlternateFileName="")) returned 1 [0078.275] GetProcessHeap () returned 0x580000 [0078.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0078.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6e8 [0078.694] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.694] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0078.703] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0078.713] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0078.722] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0078.731] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0079.035] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0079.035] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0079.035] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0079.035] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0079.035] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0079.035] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0079.036] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0079.036] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0079.036] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0079.036] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0079.036] FindNextFileW (in: hFindFile=0x64c6e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0079.036] FindClose (in: hFindFile=0x64c6e8 | out: hFindFile=0x64c6e8) returned 1 [0079.037] GetProcessHeap () returned 0x580000 [0079.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0079.037] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0079.037] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0079.037] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0079.037] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0079.037] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0079.037] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0079.037] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0079.038] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0079.039] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0079.039] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0079.039] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0079.039] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0079.039] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0079.039] FindClose (in: hFindFile=0x64c8e8 | out: hFindFile=0x64c8e8) returned 1 [0079.039] GetProcessHeap () returned 0x580000 [0079.039] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.040] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="Boot", cAlternateFileName="")) returned 1 [0079.040] GetProcessHeap () returned 0x580000 [0079.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0079.041] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64ca68 [0079.041] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.042] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD", cAlternateFileName="")) returned 1 [0079.042] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0079.042] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0079.042] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0079.042] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0079.042] GetProcessHeap () returned 0x580000 [0079.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.043] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0079.043] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.043] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.043] FindNextFileW (in: hFindFile=0x64c868, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.043] FindClose (in: hFindFile=0x64c868 | out: hFindFile=0x64c868) returned 1 [0079.044] GetProcessHeap () returned 0x580000 [0079.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.044] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0079.044] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0079.044] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0079.044] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0079.044] GetProcessHeap () returned 0x580000 [0079.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.044] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c628 [0079.045] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.045] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.045] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.045] FindNextFileW (in: hFindFile=0x64c628, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.045] FindClose (in: hFindFile=0x64c628 | out: hFindFile=0x64c628) returned 1 [0079.045] GetProcessHeap () returned 0x580000 [0079.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.045] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="da-DK", cAlternateFileName="")) returned 1 [0079.045] GetProcessHeap () returned 0x580000 [0079.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0079.046] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.046] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0079.046] GetProcessHeap () returned 0x580000 [0079.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="de-DE", cAlternateFileName="")) returned 1 [0079.046] GetProcessHeap () returned 0x580000 [0079.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.046] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c3e8 [0079.046] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.046] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.046] FindClose (in: hFindFile=0x64c3e8 | out: hFindFile=0x64c3e8) returned 1 [0079.046] GetProcessHeap () returned 0x580000 [0079.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.047] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="el-GR", cAlternateFileName="")) returned 1 [0079.047] GetProcessHeap () returned 0x580000 [0079.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.047] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.047] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.047] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.047] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.048] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0079.048] GetProcessHeap () returned 0x580000 [0079.048] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.048] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="en-GB", cAlternateFileName="")) returned 1 [0079.048] GetProcessHeap () returned 0x580000 [0079.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.048] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c528 [0079.048] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.048] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.049] FindClose (in: hFindFile=0x64c528 | out: hFindFile=0x64c528) returned 1 [0079.049] GetProcessHeap () returned 0x580000 [0079.049] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.049] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.049] GetProcessHeap () returned 0x580000 [0079.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.049] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.049] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.049] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0079.049] GetProcessHeap () returned 0x580000 [0079.049] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.049] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="es-ES", cAlternateFileName="")) returned 1 [0079.049] GetProcessHeap () returned 0x580000 [0079.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c9a8 [0079.050] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.050] FindNextFileW (in: hFindFile=0x64c9a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.050] FindClose (in: hFindFile=0x64c9a8 | out: hFindFile=0x64c9a8) returned 1 [0079.050] GetProcessHeap () returned 0x580000 [0079.050] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.050] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="es-MX", cAlternateFileName="")) returned 1 [0079.050] GetProcessHeap () returned 0x580000 [0079.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.050] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c3e8 [0079.051] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.051] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.051] FindNextFileW (in: hFindFile=0x64c3e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.051] FindClose (in: hFindFile=0x64c3e8 | out: hFindFile=0x64c3e8) returned 1 [0079.051] GetProcessHeap () returned 0x580000 [0079.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.051] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="et-EE", cAlternateFileName="")) returned 1 [0079.051] GetProcessHeap () returned 0x580000 [0079.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.052] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.052] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.052] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.052] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0079.052] GetProcessHeap () returned 0x580000 [0079.052] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.052] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0079.052] GetProcessHeap () returned 0x580000 [0079.052] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0079.053] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.053] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.053] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.053] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.053] FindClose (in: hFindFile=0x64c428 | out: hFindFile=0x64c428) returned 1 [0079.053] GetProcessHeap () returned 0x580000 [0079.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.053] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Fonts", cAlternateFileName="")) returned 1 [0079.053] GetProcessHeap () returned 0x580000 [0079.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8e8 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0079.055] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0079.056] FindNextFileW (in: hFindFile=0x64c8e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0079.056] FindClose (in: hFindFile=0x64c8e8 | out: hFindFile=0x64c8e8) returned 1 [0079.057] GetProcessHeap () returned 0x580000 [0079.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.057] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0079.057] GetProcessHeap () returned 0x580000 [0079.057] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c928 [0079.057] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.058] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.058] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.058] FindClose (in: hFindFile=0x64c928 | out: hFindFile=0x64c928) returned 1 [0079.058] GetProcessHeap () returned 0x580000 [0079.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.058] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0079.058] GetProcessHeap () returned 0x580000 [0079.058] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.058] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.058] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.058] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.059] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.059] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0079.059] GetProcessHeap () returned 0x580000 [0079.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.059] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0079.059] GetProcessHeap () returned 0x580000 [0079.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.060] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.060] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.060] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.060] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.060] GetProcessHeap () returned 0x580000 [0079.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.061] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0079.061] GetProcessHeap () returned 0x580000 [0079.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca28 [0079.061] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.061] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.061] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.061] FindNextFileW (in: hFindFile=0x64ca28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.061] FindClose (in: hFindFile=0x64ca28 | out: hFindFile=0x64ca28) returned 1 [0079.061] GetProcessHeap () returned 0x580000 [0079.061] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.061] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="it-IT", cAlternateFileName="")) returned 1 [0079.061] GetProcessHeap () returned 0x580000 [0079.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0079.062] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.062] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.062] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.062] FindNextFileW (in: hFindFile=0x64c768, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.063] FindClose (in: hFindFile=0x64c768 | out: hFindFile=0x64c768) returned 1 [0079.063] GetProcessHeap () returned 0x580000 [0079.063] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.063] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0079.063] GetProcessHeap () returned 0x580000 [0079.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.064] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.064] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.064] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.064] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.064] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.065] GetProcessHeap () returned 0x580000 [0079.065] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.065] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0079.065] GetProcessHeap () returned 0x580000 [0079.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.068] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.068] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.069] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.069] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.069] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0079.069] GetProcessHeap () returned 0x580000 [0079.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.069] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0079.069] GetProcessHeap () returned 0x580000 [0079.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8a8 [0079.069] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.069] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.069] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.069] FindClose (in: hFindFile=0x64c8a8 | out: hFindFile=0x64c8a8) returned 1 [0079.069] GetProcessHeap () returned 0x580000 [0079.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.069] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0079.069] GetProcessHeap () returned 0x580000 [0079.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cae8 [0079.073] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.073] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.073] FindNextFileW (in: hFindFile=0x64cae8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.073] FindClose (in: hFindFile=0x64cae8 | out: hFindFile=0x64cae8) returned 1 [0079.073] GetProcessHeap () returned 0x580000 [0079.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.073] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0079.073] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0079.073] GetProcessHeap () returned 0x580000 [0079.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c6a8 [0079.345] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.356] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.362] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.362] FindNextFileW (in: hFindFile=0x64c6a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.362] FindClose (in: hFindFile=0x64c6a8 | out: hFindFile=0x64c6a8) returned 1 [0079.363] GetProcessHeap () returned 0x580000 [0079.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.363] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0079.363] GetProcessHeap () returned 0x580000 [0079.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0079.363] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.363] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.363] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.363] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.363] FindClose (in: hFindFile=0x64c828 | out: hFindFile=0x64c828) returned 1 [0079.363] GetProcessHeap () returned 0x580000 [0079.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.363] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0079.363] GetProcessHeap () returned 0x580000 [0079.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.364] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.364] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0079.364] GetProcessHeap () returned 0x580000 [0079.364] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0079.364] GetProcessHeap () returned 0x580000 [0079.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0079.364] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.364] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0079.364] GetProcessHeap () returned 0x580000 [0079.364] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0079.365] GetProcessHeap () returned 0x580000 [0079.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.365] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0079.365] GetProcessHeap () returned 0x580000 [0079.365] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0079.365] GetProcessHeap () returned 0x580000 [0079.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c568 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x64c568, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.365] FindClose (in: hFindFile=0x64c568 | out: hFindFile=0x64c568) returned 1 [0079.366] GetProcessHeap () returned 0x580000 [0079.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.366] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0079.366] GetProcessHeap () returned 0x580000 [0079.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.366] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.366] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0079.366] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.366] GetProcessHeap () returned 0x580000 [0079.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.366] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.366] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0079.366] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0079.366] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.367] GetProcessHeap () returned 0x580000 [0079.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.367] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0079.367] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0079.367] GetProcessHeap () returned 0x580000 [0079.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.367] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0079.367] GetProcessHeap () returned 0x580000 [0079.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.368] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.368] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0079.368] GetProcessHeap () returned 0x580000 [0079.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0079.368] GetProcessHeap () returned 0x580000 [0079.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.368] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.369] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0079.369] GetProcessHeap () returned 0x580000 [0079.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0079.369] GetProcessHeap () returned 0x580000 [0079.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c668 [0079.369] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x64c668, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.369] FindClose (in: hFindFile=0x64c668 | out: hFindFile=0x64c668) returned 1 [0079.369] GetProcessHeap () returned 0x580000 [0079.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0079.369] GetProcessHeap () returned 0x580000 [0079.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c928 [0079.369] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.370] FindClose (in: hFindFile=0x64c928 | out: hFindFile=0x64c928) returned 1 [0079.370] GetProcessHeap () returned 0x580000 [0079.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0079.370] GetProcessHeap () returned 0x580000 [0079.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.370] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.370] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.370] GetProcessHeap () returned 0x580000 [0079.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0079.370] GetProcessHeap () returned 0x580000 [0079.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4e8 [0079.370] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.371] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.371] FindNextFileW (in: hFindFile=0x64c4e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.371] FindClose (in: hFindFile=0x64c4e8 | out: hFindFile=0x64c4e8) returned 1 [0079.371] GetProcessHeap () returned 0x580000 [0079.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.371] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0079.371] GetProcessHeap () returned 0x580000 [0079.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c4a8 [0079.371] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.371] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.371] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.371] FindNextFileW (in: hFindFile=0x64c4a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.371] FindClose (in: hFindFile=0x64c4a8 | out: hFindFile=0x64c4a8) returned 1 [0079.371] GetProcessHeap () returned 0x580000 [0079.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.371] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0079.371] GetProcessHeap () returned 0x580000 [0079.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64caa8 [0079.372] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64caa8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.372] FindClose (in: hFindFile=0x64caa8 | out: hFindFile=0x64caa8) returned 1 [0079.372] GetProcessHeap () returned 0x580000 [0079.372] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0079.372] GetProcessHeap () returned 0x580000 [0079.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64cb28 [0079.372] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64cb28, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0079.372] FindClose (in: hFindFile=0x64cb28 | out: hFindFile=0x64cb28) returned 1 [0079.372] GetProcessHeap () returned 0x580000 [0079.372] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0079.372] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0079.372] GetProcessHeap () returned 0x580000 [0079.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5e8 [0079.373] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.373] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.373] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.373] FindNextFileW (in: hFindFile=0x64c5e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.373] FindClose (in: hFindFile=0x64c5e8 | out: hFindFile=0x64c5e8) returned 1 [0079.373] GetProcessHeap () returned 0x580000 [0079.373] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.373] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0079.373] GetProcessHeap () returned 0x580000 [0079.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8a8 [0079.373] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.373] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.373] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.373] FindNextFileW (in: hFindFile=0x64c8a8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.373] FindClose (in: hFindFile=0x64c8a8 | out: hFindFile=0x64c8a8) returned 1 [0079.373] GetProcessHeap () returned 0x580000 [0079.373] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0079.374] GetProcessHeap () returned 0x580000 [0079.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7e8 [0079.374] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0079.374] FindClose (in: hFindFile=0x64c7e8 | out: hFindFile=0x64c7e8) returned 1 [0079.374] GetProcessHeap () returned 0x580000 [0079.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0079.374] FindClose (in: hFindFile=0x64ca68 | out: hFindFile=0x64ca68) returned 1 [0079.374] GetProcessHeap () returned 0x580000 [0079.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x5a825d, dwReserved1=0x75e90100, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0079.374] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="ESD", cAlternateFileName="")) returned 1 [0079.375] GetProcessHeap () returned 0x580000 [0079.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0079.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c428 [0079.388] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.388] FindNextFileW (in: hFindFile=0x64c428, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 0 [0079.388] FindClose (in: hFindFile=0x64c428 | out: hFindFile=0x64c428) returned 1 [0079.388] GetProcessHeap () returned 0x580000 [0079.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0079.388] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0079.388] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="Logs", cAlternateFileName="")) returned 1 [0079.388] GetProcessHeap () returned 0x580000 [0079.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0079.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0079.397] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0079.414] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0079.415] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0079.416] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0079.417] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0079.418] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0079.419] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0079.420] FindNextFileW (in: hFindFile=0x64c828, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0079.420] FindClose (in: hFindFile=0x64c828 | out: hFindFile=0x64c828) returned 1 [0079.421] GetProcessHeap () returned 0x580000 [0079.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0079.423] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0079.423] GetProcessHeap () returned 0x580000 [0079.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0079.423] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c528 [0079.424] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 0 [0079.424] FindClose (in: hFindFile=0x64c528 | out: hFindFile=0x64c528) returned 1 [0079.424] GetProcessHeap () returned 0x580000 [0079.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aeaf8 | out: hHeap=0x580000) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x59ac68, lpFindFileData=0x1fb9fce0 | out: lpFindFileData=0x1fb9fce0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2473c9e7, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2473c9e7, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x75e90100, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0079.424] GetProcessHeap () returned 0x580000 [0079.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x5aeaf8 [0079.424] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2473c9e7, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2473c9e7, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName=".", cAlternateFileName="")) returned 0x64c7e8 [0079.424] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x2473c9e7, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2473c9e7, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="..", cAlternateFileName="")) returned 1 [0079.424] FindNextFileW (in: hFindFile=0x64c7e8, lpFindFileData=0x1fb9fa50 | out: lpFindFileData=0x1fb9fa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x240010, dwReserved1=0x450047, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0079.425] GetProcessHeap () returned 0x580000 [0079.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0079.425] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca68 [0079.426] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.426] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0079.426] GetProcessHeap () returned 0x580000 [0079.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0079.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c528 [0079.427] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x64c528, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0079.427] FindClose (in: hFindFile=0x64c528 | out: hFindFile=0x64c528) returned 1 [0079.427] GetProcessHeap () returned 0x580000 [0079.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x64ca68, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0079.427] GetProcessHeap () returned 0x580000 [0079.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0079.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0079.427] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.427] FindNextFileW (in: hFindFile=0x64c7a8, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0079.427] GetProcessHeap () returned 0x580000 [0079.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.427] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c928 [0079.428] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.905] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0079.918] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0079.921] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0079.924] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0079.928] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0079.930] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0079.934] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0079.934] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0079.934] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0079.934] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0079.934] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0079.934] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0079.934] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0079.935] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0079.936] FindNextFileW (in: hFindFile=0x64c928, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0079.936] GetProcessHeap () returned 0x580000 [0079.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0079.937] GetProcessHeap () returned 0x580000 [0079.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0079.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52a8 [0080.131] GetProcessHeap () returned 0x580000 [0080.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4de8 [0080.131] GetProcessHeap () returned 0x580000 [0080.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.131] GetProcessHeap () returned 0x580000 [0080.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d28 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e28 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51e8 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ce8 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.132] GetProcessHeap () returned 0x580000 [0080.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4de8 [0080.133] GetProcessHeap () returned 0x580000 [0080.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.133] GetProcessHeap () returned 0x580000 [0080.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d28 [0080.133] GetProcessHeap () returned 0x580000 [0080.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.133] GetProcessHeap () returned 0x580000 [0080.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.134] GetProcessHeap () returned 0x580000 [0080.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.134] GetProcessHeap () returned 0x580000 [0080.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4de8 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5028 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.135] GetProcessHeap () returned 0x580000 [0080.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.135] GetProcessHeap () returned 0x580000 [0080.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.136] GetProcessHeap () returned 0x580000 [0080.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5268 [0080.136] GetProcessHeap () returned 0x580000 [0080.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.136] GetProcessHeap () returned 0x580000 [0080.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.136] GetProcessHeap () returned 0x580000 [0080.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51e8 [0080.137] GetProcessHeap () returned 0x580000 [0080.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.137] GetProcessHeap () returned 0x580000 [0080.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d28 [0080.137] GetProcessHeap () returned 0x580000 [0080.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.137] GetProcessHeap () returned 0x580000 [0080.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51e8 [0080.137] GetProcessHeap () returned 0x580000 [0080.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.137] GetProcessHeap () returned 0x580000 [0080.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50a8 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52e8 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.139] GetProcessHeap () returned 0x580000 [0080.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51e8 [0080.140] GetProcessHeap () returned 0x580000 [0080.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.140] GetProcessHeap () returned 0x580000 [0080.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51a8 [0080.140] GetProcessHeap () returned 0x580000 [0080.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.140] GetProcessHeap () returned 0x580000 [0080.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.140] GetProcessHeap () returned 0x580000 [0080.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.140] GetProcessHeap () returned 0x580000 [0080.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.141] GetProcessHeap () returned 0x580000 [0080.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ee8 [0080.141] GetProcessHeap () returned 0x580000 [0080.141] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.141] GetProcessHeap () returned 0x580000 [0080.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50e8 [0080.142] GetProcessHeap () returned 0x580000 [0080.142] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.142] GetProcessHeap () returned 0x580000 [0080.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50a8 [0080.142] GetProcessHeap () returned 0x580000 [0080.142] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.142] GetProcessHeap () returned 0x580000 [0080.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50a8 [0080.142] GetProcessHeap () returned 0x580000 [0080.142] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.142] GetProcessHeap () returned 0x580000 [0080.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e68 [0080.143] GetProcessHeap () returned 0x580000 [0080.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.143] GetProcessHeap () returned 0x580000 [0080.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5268 [0080.143] GetProcessHeap () returned 0x580000 [0080.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.143] GetProcessHeap () returned 0x580000 [0080.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d28 [0080.149] GetProcessHeap () returned 0x580000 [0080.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.149] GetProcessHeap () returned 0x580000 [0080.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51a8 [0080.150] GetProcessHeap () returned 0x580000 [0080.150] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.150] GetProcessHeap () returned 0x580000 [0080.150] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e68 [0080.150] GetProcessHeap () returned 0x580000 [0080.150] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.151] GetProcessHeap () returned 0x580000 [0080.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e28 [0080.151] GetProcessHeap () returned 0x580000 [0080.151] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.151] GetProcessHeap () returned 0x580000 [0080.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4de8 [0080.151] GetProcessHeap () returned 0x580000 [0080.151] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.151] GetProcessHeap () returned 0x580000 [0080.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4de8 [0080.152] GetProcessHeap () returned 0x580000 [0080.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.152] GetProcessHeap () returned 0x580000 [0080.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d68 [0080.152] GetProcessHeap () returned 0x580000 [0080.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.152] GetProcessHeap () returned 0x580000 [0080.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d28 [0080.152] GetProcessHeap () returned 0x580000 [0080.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.152] GetProcessHeap () returned 0x580000 [0080.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.153] GetProcessHeap () returned 0x580000 [0080.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.153] GetProcessHeap () returned 0x580000 [0080.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d68 [0080.153] GetProcessHeap () returned 0x580000 [0080.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.154] GetProcessHeap () returned 0x580000 [0080.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.154] GetProcessHeap () returned 0x580000 [0080.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.154] GetProcessHeap () returned 0x580000 [0080.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ce8 [0080.154] GetProcessHeap () returned 0x580000 [0080.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.154] GetProcessHeap () returned 0x580000 [0080.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50a8 [0080.154] GetProcessHeap () returned 0x580000 [0080.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.155] GetProcessHeap () returned 0x580000 [0080.155] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0080.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ee8 [0080.155] GetProcessHeap () returned 0x580000 [0080.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0080.156] GetProcessHeap () returned 0x580000 [0080.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e28 [0080.156] GetProcessHeap () returned 0x580000 [0080.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.157] GetProcessHeap () returned 0x580000 [0080.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.157] GetProcessHeap () returned 0x580000 [0080.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.157] GetProcessHeap () returned 0x580000 [0080.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52e8 [0080.157] GetProcessHeap () returned 0x580000 [0080.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.157] GetProcessHeap () returned 0x580000 [0080.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5268 [0080.158] GetProcessHeap () returned 0x580000 [0080.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.158] GetProcessHeap () returned 0x580000 [0080.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5468 [0080.158] GetProcessHeap () returned 0x580000 [0080.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.158] GetProcessHeap () returned 0x580000 [0080.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4fe8 [0080.159] GetProcessHeap () returned 0x580000 [0080.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.159] GetProcessHeap () returned 0x580000 [0080.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.159] GetProcessHeap () returned 0x580000 [0080.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ea8 [0080.159] GetProcessHeap () returned 0x580000 [0080.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52a8 [0080.160] GetProcessHeap () returned 0x580000 [0080.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.161] GetProcessHeap () returned 0x580000 [0080.161] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.161] GetProcessHeap () returned 0x580000 [0080.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff5168 [0080.163] GetProcessHeap () returned 0x580000 [0080.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff52e8 [0080.165] GetProcessHeap () returned 0x580000 [0080.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.165] GetProcessHeap () returned 0x580000 [0080.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.166] GetProcessHeap () returned 0x580000 [0080.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff51a8 [0080.167] GetProcessHeap () returned 0x580000 [0080.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.167] GetProcessHeap () returned 0x580000 [0080.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ce8 [0080.167] GetProcessHeap () returned 0x580000 [0080.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.167] GetProcessHeap () returned 0x580000 [0080.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4d68 [0080.169] GetProcessHeap () returned 0x580000 [0080.169] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.170] GetProcessHeap () returned 0x580000 [0080.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4e28 [0080.170] GetProcessHeap () returned 0x580000 [0080.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4fa8 [0080.170] GetProcessHeap () returned 0x580000 [0080.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.170] GetProcessHeap () returned 0x580000 [0080.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.171] GetProcessHeap () returned 0x580000 [0080.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4f68 [0080.172] GetProcessHeap () returned 0x580000 [0080.172] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe44b0 [0080.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4fa8 [0080.172] GetProcessHeap () returned 0x580000 [0080.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe44b0 | out: hHeap=0x580000) returned 1 [0080.173] GetProcessHeap () returned 0x580000 [0080.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.173] GetProcessHeap () returned 0x580000 [0080.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8a8 [0080.344] GetProcessHeap () returned 0x580000 [0080.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.355] GetProcessHeap () returned 0x580000 [0080.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0080.355] GetProcessHeap () returned 0x580000 [0080.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.355] GetProcessHeap () returned 0x580000 [0080.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.355] GetProcessHeap () returned 0x580000 [0080.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0080.356] GetProcessHeap () returned 0x580000 [0080.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.356] GetProcessHeap () returned 0x580000 [0080.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0080.356] GetProcessHeap () returned 0x580000 [0080.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.357] GetProcessHeap () returned 0x580000 [0080.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.357] GetProcessHeap () returned 0x580000 [0080.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.358] GetProcessHeap () returned 0x580000 [0080.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.358] GetProcessHeap () returned 0x580000 [0080.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.358] GetProcessHeap () returned 0x580000 [0080.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.360] GetProcessHeap () returned 0x580000 [0080.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.361] GetProcessHeap () returned 0x580000 [0080.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0080.362] GetProcessHeap () returned 0x580000 [0080.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.362] GetProcessHeap () returned 0x580000 [0080.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.363] GetProcessHeap () returned 0x580000 [0080.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.364] GetProcessHeap () returned 0x580000 [0080.364] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.364] GetProcessHeap () returned 0x580000 [0080.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c8a8 [0080.366] GetProcessHeap () returned 0x580000 [0080.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.366] GetProcessHeap () returned 0x580000 [0080.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.367] GetProcessHeap () returned 0x580000 [0080.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.367] GetProcessHeap () returned 0x580000 [0080.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.369] GetProcessHeap () returned 0x580000 [0080.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0080.370] GetProcessHeap () returned 0x580000 [0080.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.370] GetProcessHeap () returned 0x580000 [0080.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.371] GetProcessHeap () returned 0x580000 [0080.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.371] GetProcessHeap () returned 0x580000 [0080.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.372] GetProcessHeap () returned 0x580000 [0080.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d83195, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0080.373] GetProcessHeap () returned 0x580000 [0080.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca68 [0080.374] GetProcessHeap () returned 0x580000 [0080.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0080.374] GetProcessHeap () returned 0x580000 [0080.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64ca68 [0080.374] GetProcessHeap () returned 0x580000 [0080.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0080.374] GetProcessHeap () returned 0x580000 [0080.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0080.374] GetProcessHeap () returned 0x580000 [0080.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0080.374] GetProcessHeap () returned 0x580000 [0080.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.375] GetProcessHeap () returned 0x580000 [0080.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c5a8 [0080.376] GetProcessHeap () returned 0x580000 [0080.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c768 [0080.376] GetProcessHeap () returned 0x580000 [0080.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0080.379] GetProcessHeap () returned 0x580000 [0080.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.380] GetProcessHeap () returned 0x580000 [0080.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.381] GetProcessHeap () returned 0x580000 [0080.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.381] GetProcessHeap () returned 0x580000 [0080.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.382] GetProcessHeap () returned 0x580000 [0080.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.382] GetProcessHeap () returned 0x580000 [0080.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.382] GetProcessHeap () returned 0x580000 [0080.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.383] GetProcessHeap () returned 0x580000 [0080.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c7a8 [0080.386] GetProcessHeap () returned 0x580000 [0080.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.388] GetProcessHeap () returned 0x580000 [0080.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.388] GetProcessHeap () returned 0x580000 [0080.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.388] GetProcessHeap () returned 0x580000 [0080.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.388] GetProcessHeap () returned 0x580000 [0080.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c828 [0080.389] GetProcessHeap () returned 0x580000 [0080.389] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.389] GetProcessHeap () returned 0x580000 [0080.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.389] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.565] GetProcessHeap () returned 0x580000 [0080.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.565] GetProcessHeap () returned 0x580000 [0080.566] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.585] GetProcessHeap () returned 0x580000 [0080.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.585] GetProcessHeap () returned 0x580000 [0080.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.587] GetProcessHeap () returned 0x580000 [0080.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.587] GetProcessHeap () returned 0x580000 [0080.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.588] GetProcessHeap () returned 0x580000 [0080.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.592] GetProcessHeap () returned 0x580000 [0080.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.592] GetProcessHeap () returned 0x580000 [0080.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.593] GetProcessHeap () returned 0x580000 [0080.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.594] GetProcessHeap () returned 0x580000 [0080.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.594] GetProcessHeap () returned 0x580000 [0080.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.597] GetProcessHeap () returned 0x580000 [0080.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.597] GetProcessHeap () returned 0x580000 [0080.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.602] GetProcessHeap () returned 0x580000 [0080.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.602] GetProcessHeap () returned 0x580000 [0080.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.603] GetProcessHeap () returned 0x580000 [0080.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0080.603] GetProcessHeap () returned 0x580000 [0080.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0080.603] GetProcessHeap () returned 0x580000 [0080.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0080.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x20569715, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x20569715, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4b68 [0080.604] GetProcessHeap () returned 0x580000 [0080.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.604] GetProcessHeap () returned 0x580000 [0080.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0080.604] GetProcessHeap () returned 0x580000 [0080.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.606] GetProcessHeap () returned 0x580000 [0080.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0080.606] GetProcessHeap () returned 0x580000 [0080.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0080.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4be8 [0080.606] GetProcessHeap () returned 0x580000 [0080.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.608] GetProcessHeap () returned 0x580000 [0080.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.609] GetProcessHeap () returned 0x580000 [0080.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.609] GetProcessHeap () returned 0x580000 [0080.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4c28 [0080.616] GetProcessHeap () returned 0x580000 [0080.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.616] GetProcessHeap () returned 0x580000 [0080.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4c28 [0080.616] GetProcessHeap () returned 0x580000 [0080.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0080.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff50e8 [0080.617] GetProcessHeap () returned 0x580000 [0080.617] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0080.617] GetProcessHeap () returned 0x580000 [0080.617] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.618] GetProcessHeap () returned 0x580000 [0080.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.618] GetProcessHeap () returned 0x580000 [0080.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.619] GetProcessHeap () returned 0x580000 [0080.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4c28 [0080.620] GetProcessHeap () returned 0x580000 [0080.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.620] GetProcessHeap () returned 0x580000 [0080.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4c28 [0080.621] GetProcessHeap () returned 0x580000 [0080.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.621] GetProcessHeap () returned 0x580000 [0080.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0080.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4c28 [0080.623] GetProcessHeap () returned 0x580000 [0080.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0080.623] GetProcessHeap () returned 0x580000 [0080.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.624] GetProcessHeap () returned 0x580000 [0080.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.626] GetProcessHeap () returned 0x580000 [0080.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.626] GetProcessHeap () returned 0x580000 [0080.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.629] GetProcessHeap () returned 0x580000 [0080.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.629] GetProcessHeap () returned 0x580000 [0080.629] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4ba8 [0080.633] GetProcessHeap () returned 0x580000 [0080.633] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0080.633] GetProcessHeap () returned 0x580000 [0080.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0080.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1fff4c28 [0081.329] GetProcessHeap () returned 0x580000 [0081.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0081.532] GetProcessHeap () returned 0x580000 [0081.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0081.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0081.535] GetProcessHeap () returned 0x580000 [0081.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0081.535] GetProcessHeap () returned 0x580000 [0081.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0081.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0081.536] GetProcessHeap () returned 0x580000 [0081.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0081.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0081.545] GetProcessHeap () returned 0x580000 [0081.545] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0081.545] GetProcessHeap () returned 0x580000 [0081.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0081.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0081.546] GetProcessHeap () returned 0x580000 [0081.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0081.546] GetProcessHeap () returned 0x580000 [0081.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0081.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0081.546] GetProcessHeap () returned 0x580000 [0081.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0081.547] GetProcessHeap () returned 0x580000 [0081.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0081.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0081.550] GetProcessHeap () returned 0x580000 [0081.550] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0081.550] GetProcessHeap () returned 0x580000 [0081.550] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0081.552] GetProcessHeap () returned 0x580000 [0081.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0081.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0081.555] GetProcessHeap () returned 0x580000 [0081.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0081.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0081.557] GetProcessHeap () returned 0x580000 [0081.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0081.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0081.558] GetProcessHeap () returned 0x580000 [0081.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0081.558] GetProcessHeap () returned 0x580000 [0081.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0081.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x99937c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99937c0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x64c868 [0081.561] GetProcessHeap () returned 0x580000 [0081.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0081.572] GetProcessHeap () returned 0x580000 [0081.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0081.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002db78 [0081.973] GetProcessHeap () returned 0x580000 [0081.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0081.973] GetProcessHeap () returned 0x580000 [0081.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0081.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002dab8 [0082.444] GetProcessHeap () returned 0x580000 [0082.444] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0082.444] GetProcessHeap () returned 0x580000 [0082.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0082.445] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002dab8 [0082.477] GetProcessHeap () returned 0x580000 [0082.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0082.665] GetProcessHeap () returned 0x580000 [0082.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0082.666] GetProcessHeap () returned 0x580000 [0082.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0082.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0082.667] GetProcessHeap () returned 0x580000 [0082.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0082.668] GetProcessHeap () returned 0x580000 [0082.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0082.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0082.668] GetProcessHeap () returned 0x580000 [0082.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0082.668] GetProcessHeap () returned 0x580000 [0082.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0082.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0082.668] GetProcessHeap () returned 0x580000 [0082.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0082.668] GetProcessHeap () returned 0x580000 [0082.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0082.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1335b74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1335b74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0082.670] GetProcessHeap () returned 0x580000 [0082.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0082.670] GetProcessHeap () returned 0x580000 [0082.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0082.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0082.671] GetProcessHeap () returned 0x580000 [0082.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff70060 [0082.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0082.671] GetProcessHeap () returned 0x580000 [0082.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0082.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0082.671] GetProcessHeap () returned 0x580000 [0082.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0082.673] GetProcessHeap () returned 0x580000 [0082.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.674] GetProcessHeap () returned 0x580000 [0082.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0082.690] GetProcessHeap () returned 0x580000 [0082.690] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.690] GetProcessHeap () returned 0x580000 [0082.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0082.724] GetProcessHeap () returned 0x580000 [0082.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.724] GetProcessHeap () returned 0x580000 [0082.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0082.726] GetProcessHeap () returned 0x580000 [0082.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.726] GetProcessHeap () returned 0x580000 [0082.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0082.732] GetProcessHeap () returned 0x580000 [0082.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.732] GetProcessHeap () returned 0x580000 [0082.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0082.734] GetProcessHeap () returned 0x580000 [0082.734] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.734] GetProcessHeap () returned 0x580000 [0082.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0082.737] GetProcessHeap () returned 0x580000 [0082.737] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.737] GetProcessHeap () returned 0x580000 [0082.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0082.739] GetProcessHeap () returned 0x580000 [0082.739] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.739] GetProcessHeap () returned 0x580000 [0082.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0082.741] GetProcessHeap () returned 0x580000 [0082.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.741] GetProcessHeap () returned 0x580000 [0082.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0082.859] GetProcessHeap () returned 0x580000 [0082.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.859] GetProcessHeap () returned 0x580000 [0082.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0082.860] GetProcessHeap () returned 0x580000 [0082.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.860] GetProcessHeap () returned 0x580000 [0082.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0082.862] GetProcessHeap () returned 0x580000 [0082.862] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.862] GetProcessHeap () returned 0x580000 [0082.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0082.892] GetProcessHeap () returned 0x580000 [0082.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.892] GetProcessHeap () returned 0x580000 [0082.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0082.896] GetProcessHeap () returned 0x580000 [0082.896] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.896] GetProcessHeap () returned 0x580000 [0082.896] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0082.897] GetProcessHeap () returned 0x580000 [0082.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.897] GetProcessHeap () returned 0x580000 [0082.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0082.899] GetProcessHeap () returned 0x580000 [0082.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.899] GetProcessHeap () returned 0x580000 [0082.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0082.901] GetProcessHeap () returned 0x580000 [0082.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.901] GetProcessHeap () returned 0x580000 [0082.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0082.904] GetProcessHeap () returned 0x580000 [0082.904] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.904] GetProcessHeap () returned 0x580000 [0082.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0082.907] GetProcessHeap () returned 0x580000 [0082.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.907] GetProcessHeap () returned 0x580000 [0082.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0082.908] GetProcessHeap () returned 0x580000 [0082.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.908] GetProcessHeap () returned 0x580000 [0082.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0082.911] GetProcessHeap () returned 0x580000 [0082.911] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.911] GetProcessHeap () returned 0x580000 [0082.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0082.912] GetProcessHeap () returned 0x580000 [0082.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.912] GetProcessHeap () returned 0x580000 [0082.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0082.914] GetProcessHeap () returned 0x580000 [0082.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.915] GetProcessHeap () returned 0x580000 [0082.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lv\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0082.916] GetProcessHeap () returned 0x580000 [0082.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.916] GetProcessHeap () returned 0x580000 [0082.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ms\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0082.918] GetProcessHeap () returned 0x580000 [0082.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.918] GetProcessHeap () returned 0x580000 [0082.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\nl\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0082.919] GetProcessHeap () returned 0x580000 [0082.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.919] GetProcessHeap () returned 0x580000 [0082.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\no\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0082.921] GetProcessHeap () returned 0x580000 [0082.921] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.921] GetProcessHeap () returned 0x580000 [0082.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pl\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf854e731, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0082.922] GetProcessHeap () returned 0x580000 [0082.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0082.923] GetProcessHeap () returned 0x580000 [0082.923] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0082.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-BR\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0083.077] GetProcessHeap () returned 0x580000 [0083.079] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.080] GetProcessHeap () returned 0x580000 [0083.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\pt-pt\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0083.200] GetProcessHeap () returned 0x580000 [0083.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.200] GetProcessHeap () returned 0x580000 [0083.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ro\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0083.201] GetProcessHeap () returned 0x580000 [0083.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.201] GetProcessHeap () returned 0x580000 [0083.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ru\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0083.203] GetProcessHeap () returned 0x580000 [0083.203] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.203] GetProcessHeap () returned 0x580000 [0083.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sk\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0083.205] GetProcessHeap () returned 0x580000 [0083.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.205] GetProcessHeap () returned 0x580000 [0083.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sl\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0083.207] GetProcessHeap () returned 0x580000 [0083.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.207] GetProcessHeap () returned 0x580000 [0083.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Cyrl\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0083.209] GetProcessHeap () returned 0x580000 [0083.209] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.209] GetProcessHeap () returned 0x580000 [0083.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0083.211] GetProcessHeap () returned 0x580000 [0083.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.211] GetProcessHeap () returned 0x580000 [0083.211] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.211] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sr-Latn-CS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0083.213] GetProcessHeap () returned 0x580000 [0083.213] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.213] GetProcessHeap () returned 0x580000 [0083.214] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.214] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\sv\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0083.215] GetProcessHeap () returned 0x580000 [0083.215] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.215] GetProcessHeap () returned 0x580000 [0083.215] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.215] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\th\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1860d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0083.216] GetProcessHeap () returned 0x580000 [0083.217] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.217] GetProcessHeap () returned 0x580000 [0083.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\tr\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0083.218] GetProcessHeap () returned 0x580000 [0083.218] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.218] GetProcessHeap () returned 0x580000 [0083.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.218] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\uk\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0083.221] GetProcessHeap () returned 0x580000 [0083.221] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.221] GetProcessHeap () returned 0x580000 [0083.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.221] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\vi\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0083.223] GetProcessHeap () returned 0x580000 [0083.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.223] GetProcessHeap () returned 0x580000 [0083.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.223] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0083.225] GetProcessHeap () returned 0x580000 [0083.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.225] GetProcessHeap () returned 0x580000 [0083.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.225] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\zh-HANT\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0083.226] GetProcessHeap () returned 0x580000 [0083.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.226] GetProcessHeap () returned 0x580000 [0083.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.227] GetProcessHeap () returned 0x580000 [0083.227] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff70060 | out: hHeap=0x580000) returned 1 [0083.227] GetProcessHeap () returned 0x580000 [0083.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.228] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power Map Excel Add-in\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0083.229] GetProcessHeap () returned 0x580000 [0083.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.229] GetProcessHeap () returned 0x580000 [0083.229] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0083.229] GetProcessHeap () returned 0x580000 [0083.229] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ar\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0083.231] GetProcessHeap () returned 0x580000 [0083.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.231] GetProcessHeap () returned 0x580000 [0083.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.231] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\bg\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0083.233] GetProcessHeap () returned 0x580000 [0083.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.233] GetProcessHeap () returned 0x580000 [0083.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.233] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ca\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0083.234] GetProcessHeap () returned 0x580000 [0083.234] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.234] GetProcessHeap () returned 0x580000 [0083.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\cs\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0083.236] GetProcessHeap () returned 0x580000 [0083.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.236] GetProcessHeap () returned 0x580000 [0083.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.236] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\da\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0083.447] GetProcessHeap () returned 0x580000 [0083.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.447] GetProcessHeap () returned 0x580000 [0083.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\de\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0083.449] GetProcessHeap () returned 0x580000 [0083.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.449] GetProcessHeap () returned 0x580000 [0083.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\el\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0083.451] GetProcessHeap () returned 0x580000 [0083.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.451] GetProcessHeap () returned 0x580000 [0083.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\es\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0083.453] GetProcessHeap () returned 0x580000 [0083.453] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.453] GetProcessHeap () returned 0x580000 [0083.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\et\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0083.454] GetProcessHeap () returned 0x580000 [0083.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.455] GetProcessHeap () returned 0x580000 [0083.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\eu\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0083.456] GetProcessHeap () returned 0x580000 [0083.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.456] GetProcessHeap () returned 0x580000 [0083.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fi\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0083.458] GetProcessHeap () returned 0x580000 [0083.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.458] GetProcessHeap () returned 0x580000 [0083.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\fr\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0083.460] GetProcessHeap () returned 0x580000 [0083.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.460] GetProcessHeap () returned 0x580000 [0083.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\gl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0083.465] GetProcessHeap () returned 0x580000 [0083.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.466] GetProcessHeap () returned 0x580000 [0083.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\he\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0083.467] GetProcessHeap () returned 0x580000 [0083.467] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.467] GetProcessHeap () returned 0x580000 [0083.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hi\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0083.469] GetProcessHeap () returned 0x580000 [0083.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.469] GetProcessHeap () returned 0x580000 [0083.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hr\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0083.470] GetProcessHeap () returned 0x580000 [0083.470] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.470] GetProcessHeap () returned 0x580000 [0083.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\hu\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0083.472] GetProcessHeap () returned 0x580000 [0083.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.472] GetProcessHeap () returned 0x580000 [0083.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\id\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0083.473] GetProcessHeap () returned 0x580000 [0083.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.473] GetProcessHeap () returned 0x580000 [0083.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\it\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0083.475] GetProcessHeap () returned 0x580000 [0083.475] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.475] GetProcessHeap () returned 0x580000 [0083.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ja\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0083.477] GetProcessHeap () returned 0x580000 [0083.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.477] GetProcessHeap () returned 0x580000 [0083.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.477] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\kk\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0083.478] GetProcessHeap () returned 0x580000 [0083.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.478] GetProcessHeap () returned 0x580000 [0083.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ko\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0083.480] GetProcessHeap () returned 0x580000 [0083.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.480] GetProcessHeap () returned 0x580000 [0083.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lt\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0083.481] GetProcessHeap () returned 0x580000 [0083.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.481] GetProcessHeap () returned 0x580000 [0083.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.481] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\lv\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0083.483] GetProcessHeap () returned 0x580000 [0083.483] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.483] GetProcessHeap () returned 0x580000 [0083.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ms\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ab259c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ab259c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0083.484] GetProcessHeap () returned 0x580000 [0083.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.484] GetProcessHeap () returned 0x580000 [0083.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\nl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0083.486] GetProcessHeap () returned 0x580000 [0083.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.486] GetProcessHeap () returned 0x580000 [0083.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0083.486] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\no\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0083.708] GetProcessHeap () returned 0x580000 [0083.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0083.708] GetProcessHeap () returned 0x580000 [0083.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0083.710] GetProcessHeap () returned 0x580000 [0083.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.710] GetProcessHeap () returned 0x580000 [0083.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.710] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0083.712] GetProcessHeap () returned 0x580000 [0083.712] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.712] GetProcessHeap () returned 0x580000 [0083.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\pt-PT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0083.716] GetProcessHeap () returned 0x580000 [0083.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.716] GetProcessHeap () returned 0x580000 [0083.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.716] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ro\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0083.718] GetProcessHeap () returned 0x580000 [0083.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.718] GetProcessHeap () returned 0x580000 [0083.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\ru\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0083.719] GetProcessHeap () returned 0x580000 [0083.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.720] GetProcessHeap () returned 0x580000 [0083.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sk\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0083.721] GetProcessHeap () returned 0x580000 [0083.721] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.721] GetProcessHeap () returned 0x580000 [0083.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0083.723] GetProcessHeap () returned 0x580000 [0083.723] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.723] GetProcessHeap () returned 0x580000 [0083.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0083.731] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.731] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a2a905, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1600fa20, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc40a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.731] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5ab1579, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5ab1579, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.731] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d05722, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.731] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d50bdc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d50bdc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d50bdc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.731] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15f04999, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f9d2e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-cyrl.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.731] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15f04999, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f9d2e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x51f6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-cyrl.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.731] FindClose (in: hFindFile=0x2002a3e0 | out: hFindFile=0x2002a3e0) returned 1 [0083.732] GetProcessHeap () returned 0x580000 [0083.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.732] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0083.732] GetProcessHeap () returned 0x580000 [0083.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-latn\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0083.735] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.735] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.735] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aa3169, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aa3169, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aa3169, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.735] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aa3169, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.735] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x59b433, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x59b433, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59b433, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.735] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x160a83ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1611aacd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-latn.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.735] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x160a83ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1611aacd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-latn.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.735] FindClose (in: hFindFile=0x20029ee0 | out: hFindFile=0x20029ee0) returned 1 [0083.736] GetProcessHeap () returned 0x580000 [0083.736] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.736] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0083.736] GetProcessHeap () returned 0x580000 [0083.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0083.737] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.737] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45f9db0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x15f50e21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc40b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.737] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x443f20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x443f20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.737] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6f2911, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6f2911, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6f2911, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.737] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4710, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.737] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ede724, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-Latn-CS.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.738] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x15ede724, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sr-Latn-CS.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.738] FindClose (in: hFindFile=0x20029d60 | out: hFindFile=0x20029d60) returned 1 [0083.739] GetProcessHeap () returned 0x580000 [0083.739] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.739] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0083.739] GetProcessHeap () returned 0x580000 [0083.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\sv\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0083.740] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.740] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3a5b63a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3a5b63a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc3ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.740] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbdc8437, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbdc8437, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.740] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb713a45, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb713a45, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb78613f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.740] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.740] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16035c5a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ea7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sv.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.740] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16035c5a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ea7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.sv.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.740] FindClose (in: hFindFile=0x20029de0 | out: hFindFile=0x20029de0) returned 1 [0083.741] GetProcessHeap () returned 0x580000 [0083.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.741] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0083.741] GetProcessHeap () returned 0x580000 [0083.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.741] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\th\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0083.742] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.742] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c66c57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x161b33fa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc3c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.742] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa5581c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa853100, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1baa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.742] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x624ad43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.742] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf81bae82, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf81bae82, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf8574958, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.742] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16166f59, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1618d1a2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.th.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.742] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16166f59, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1618d1a2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x50d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.th.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.742] FindClose (in: hFindFile=0x2002a2a0 | out: hFindFile=0x2002a2a0) returned 1 [0083.743] GetProcessHeap () returned 0x580000 [0083.743] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.743] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0083.743] GetProcessHeap () returned 0x580000 [0083.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.743] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\tr\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0083.745] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.745] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x196cd32, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x196cd32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1618d1a2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4458, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.745] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x514e0d9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x514e0d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5174318, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.745] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.745] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1de43d5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1de43d5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4910, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.746] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16140cde, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f05e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.tr.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.746] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16140cde, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f05e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.tr.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.746] FindClose (in: hFindFile=0x2002a4e0 | out: hFindFile=0x2002a4e0) returned 1 [0083.746] GetProcessHeap () returned 0x580000 [0083.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.746] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0083.746] GetProcessHeap () returned 0x580000 [0083.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\uk\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0083.747] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.747] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x48cfa7d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x48cfa7d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16546d20, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.747] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.748] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc240ad7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc240ad7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.748] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b9ee02, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7bc5054, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.748] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161ff8f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.uk.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.748] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161ff8f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x52560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.uk.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.748] FindClose (in: hFindFile=0x2002a0e0 | out: hFindFile=0x2002a0e0) returned 1 [0083.748] GetProcessHeap () returned 0x580000 [0083.748] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.748] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0083.749] GetProcessHeap () returned 0x580000 [0083.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\vi\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0083.749] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.749] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.750] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa5581c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa68949f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.750] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf637b042, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf637b042, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.750] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa531f86, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5440, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.750] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f7f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.vi.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.750] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x161d962a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4f7f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.vi.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.750] FindClose (in: hFindFile=0x2002a0e0 | out: hFindFile=0x2002a0e0) returned 1 [0083.751] GetProcessHeap () returned 0x580000 [0083.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.751] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0083.751] GetProcessHeap () returned 0x580000 [0083.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHS\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0083.865] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.865] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c15e5f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc0ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.865] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a0a7fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a0a7fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a0a7fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.865] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x624ad43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.865] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6297232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6297232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6297232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.865] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e757, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.zh-CHS.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.865] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e757, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.zh-CHS.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.865] FindClose (in: hFindFile=0x2002a3e0 | out: hFindFile=0x2002a3e0) returned 1 [0083.866] GetProcessHeap () returned 0x580000 [0083.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.866] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0083.866] GetProcessHeap () returned 0x580000 [0083.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Power View Excel Add-in\\zh-CHT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0083.867] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.867] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164d461d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc1040, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdHocReportingExcelClient.dll", cAlternateFileName="ADHOCR~1.DLL")) returned 1 [0083.867] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf47e9c8f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.867] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb8b74ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb8b74ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdHoc.Excel.Client.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.867] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5101cbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5127e7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.AdomdDataExtension.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.867] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164159c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16461eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4eb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.zh-CHT.xap", cAlternateFileName="POWERV~1.XAP")) returned 1 [0083.867] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164159c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16461eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4eb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerViewRes.zh-CHT.xap", cAlternateFileName="POWERV~1.XAP")) returned 0 [0083.867] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0083.868] GetProcessHeap () returned 0x580000 [0083.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.868] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0083.868] FindClose (in: hFindFile=0x20029fa0 | out: hFindFile=0x20029fa0) returned 1 [0083.868] GetProcessHeap () returned 0x580000 [0083.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0083.869] FindNextFileW (in: hFindFile=0x2002a4a0, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0083.869] GetProcessHeap () returned 0x580000 [0083.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0083.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0083.870] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.870] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0083.870] GetProcessHeap () returned 0x580000 [0083.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.870] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ar\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0083.871] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.871] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.871] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a13a8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0083.871] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a0a7fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a0a7fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a30a43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a77594, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a77594, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a77594, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x688d06d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x688d06d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x688d06d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20d030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1698075, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1698075, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1698075, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5ad77c9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5ad77c9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5fc257f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6223b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6223b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x49aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd422, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xfbd422, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1698075, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc3e44f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc3e44f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc3e44f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x73ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf483611a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf483611a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4a25fae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45f9db0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45f9db0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18d43c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18d43c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18d43c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x54ef2e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x54ef2e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0083.872] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d9e0b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d9e0b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d9e0b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0083.873] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d9e0b3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d9e0b3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d9e0b3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0083.873] FindClose (in: hFindFile=0x2002a220 | out: hFindFile=0x2002a220) returned 1 [0083.873] GetProcessHeap () returned 0x580000 [0083.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.873] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0083.873] GetProcessHeap () returned 0x580000 [0083.873] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\bg\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0083.874] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.880] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1639, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.880] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d76e38, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d76e38, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d76e38, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0083.880] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd09866, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd09866, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0083.880] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0083.880] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9c75fa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9c75fa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa13ab7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20d030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44563cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44563cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44c8b33, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2fa0ca2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2fa0ca2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fed144, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45f9db0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45f9db0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4d050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45d3b76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45f9db0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6aee686, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6aee686, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56f7a52, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56f7a52, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56f7a52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x19040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99462e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99462e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9992797, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1baa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa853100, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa853100, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa853100, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x75040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf311d3eb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf311d3eb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf311d3eb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc51578a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc51578a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf71003, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xfe368d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4640, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x48f5cfa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x48f5cfa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x48f5cfa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ac3289, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ac3289, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ac3289, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ac3289, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0083.881] FindClose (in: hFindFile=0x2002a4e0 | out: hFindFile=0x2002a4e0) returned 1 [0083.882] GetProcessHeap () returned 0x580000 [0083.882] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.882] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0083.882] GetProcessHeap () returned 0x580000 [0083.882] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ca\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0083.883] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.883] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16605845, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.883] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa4995f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd028, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.883] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd55d11, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x38af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0083.883] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x680214, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56ab5a1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56ab5a1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x201030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa806c3d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa853100, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x688d06d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x688d06d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x688d06d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ca98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2ee20e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f2e583, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56f7a52, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56f7a52, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56f7a52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x865a7d2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0e95c0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0e95c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2ee20e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f2e583, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e7d566, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e7d566, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x70ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37acc11, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37acc11, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37acc11, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf71003, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xfe368d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc5d437d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc5d437d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc5fa5d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5174318, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5174318, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x519a5bb, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa31be8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa31be8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa4733b6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0083.884] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa31be8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa31be8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa4733b6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0083.884] FindClose (in: hFindFile=0x2002a360 | out: hFindFile=0x2002a360) returned 1 [0083.885] GetProcessHeap () returned 0x580000 [0083.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.885] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0083.885] GetProcessHeap () returned 0x580000 [0083.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Cartridges\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16546d20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16546d20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x165b9401, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x75ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="db2v0801.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164d461d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164d461d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164d461d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1816e, dwReserved0=0x0, dwReserved1=0x0, cFileName="hive.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164ae360, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7b27, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164d461d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164d461d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164d461d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7339, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164ae360, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8a2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="orcl7.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x164ae360, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164ae360, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x858c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16736b69, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16736b69, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x18559, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16677f4b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16677f4b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x166ea6b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1393e, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlpdw.xsl", cAlternateFileName="")) returned 1 [0083.887] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x166ea6b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x166ea6b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x76a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0083.888] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1662bb01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c42, dwReserved0=0x0, dwReserved1=0x0, cFileName="trdtv2r41.xsl", cAlternateFileName="TRDTV2~1.XSL")) returned 1 [0083.888] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1662bb01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6c42, dwReserved0=0x0, dwReserved1=0x0, cFileName="trdtv2r41.xsl", cAlternateFileName="TRDTV2~1.XSL")) returned 0 [0083.888] FindClose (in: hFindFile=0x20029da0 | out: hFindFile=0x20029da0) returned 1 [0083.888] GetProcessHeap () returned 0x580000 [0083.888] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.888] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0083.888] GetProcessHeap () returned 0x580000 [0083.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\cs\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16651cf9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16677f4b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1108, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa853100, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa853100, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa879350, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61d7668, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x765018, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x765018, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x765018, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ff030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6297232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6297232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6297232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0083.890] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa937f07, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae22cc9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6034d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6034d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x605aed7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4d48116, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4d48116, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc34bb5b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc34bb5b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc3e44f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42b29f3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0063153, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86f312a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86f312a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a04f26, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a04f26, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a04f26, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc3c8ab, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc3c8ab, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x897b914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x897b914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x97c9c99, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0083.891] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x897b914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x897b914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x97c9c99, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0083.891] FindClose (in: hFindFile=0x2002a460 | out: hFindFile=0x2002a460) returned 1 [0083.892] GetProcessHeap () returned 0x580000 [0083.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.892] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0083.892] GetProcessHeap () returned 0x580000 [0083.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\da\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0083.893] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.893] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1662bb01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1096, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.894] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf07af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf07af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf07af2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0083.894] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3f46636, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3f46636, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3f46636, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0083.894] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d4bb8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d4bb8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d71cd8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.894] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99462e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99462e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99462e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fda98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0083.894] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0083.894] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80fc2c4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80fc2c4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80fc2c4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3143659, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3143659, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x305f84a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x305f84a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36c7dee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5478, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf10a1263, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12910b6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1a078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0083.926] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e0a643, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.927] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xaad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0083.927] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x575324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x575324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59b433, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0083.927] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd7bf89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0083.927] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb6089d0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb6089d0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb654e78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0083.927] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb6089d0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb6089d0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb654e78, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0083.927] FindClose (in: hFindFile=0x20029f60 | out: hFindFile=0x20029f60) returned 1 [0083.928] GetProcessHeap () returned 0x580000 [0083.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.928] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0083.928] GetProcessHeap () returned 0x580000 [0083.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\de\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0083.928] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51c07e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51c07e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51c07e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86cced8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86cced8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86cced8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf64139b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf64139b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6bd443f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6bd443f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bd443f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x201030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41f3e26, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1e038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2fa0ca2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2fa0ca2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fa0ca2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c45b55, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c45b55, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c45b55, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x238ed8d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x238ed8d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e95d39, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.929] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb86af90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb86af90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb86af90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0083.930] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b61d36, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0083.930] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2ff666, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2ff666, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2ff666, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xaad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0083.930] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0083.930] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.930] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0083.930] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0083.930] FindClose (in: hFindFile=0x2002a320 | out: hFindFile=0x2002a320) returned 1 [0083.931] GetProcessHeap () returned 0x580000 [0083.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.931] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0083.931] GetProcessHeap () returned 0x580000 [0083.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\el\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0083.931] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x169d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf073ddf4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf073ddf4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa68949f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa68949f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa806c3d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x38aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4cfac8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cfac8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x211030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bad1cb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bad1cb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x25040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff580e7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0063153, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4baa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6866e01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61d7668, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1aaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x860e337, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x860e337, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0083.932] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf126aeb1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf126aeb1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12b7378, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x76040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0083.933] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0083.933] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf75a8fbb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf75a8fbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf75a8fbb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0083.933] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e78ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0083.935] GetProcessHeap () returned 0x580000 [0083.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0083.935] GetProcessHeap () returned 0x580000 [0083.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0083.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\en\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0084.080] GetProcessHeap () returned 0x580000 [0084.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.080] GetProcessHeap () returned 0x580000 [0084.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\es\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0084.083] GetProcessHeap () returned 0x580000 [0084.083] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.083] GetProcessHeap () returned 0x580000 [0084.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\et\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0084.084] GetProcessHeap () returned 0x580000 [0084.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.084] GetProcessHeap () returned 0x580000 [0084.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\eu\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0084.086] GetProcessHeap () returned 0x580000 [0084.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.086] GetProcessHeap () returned 0x580000 [0084.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fi\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0084.087] GetProcessHeap () returned 0x580000 [0084.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.088] GetProcessHeap () returned 0x580000 [0084.088] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\fr\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0084.089] GetProcessHeap () returned 0x580000 [0084.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.089] GetProcessHeap () returned 0x580000 [0084.089] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\gl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0084.091] GetProcessHeap () returned 0x580000 [0084.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.091] GetProcessHeap () returned 0x580000 [0084.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\he\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0084.092] GetProcessHeap () returned 0x580000 [0084.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.092] GetProcessHeap () returned 0x580000 [0084.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hi\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0084.094] GetProcessHeap () returned 0x580000 [0084.094] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.094] GetProcessHeap () returned 0x580000 [0084.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hr\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0084.095] GetProcessHeap () returned 0x580000 [0084.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.095] GetProcessHeap () returned 0x580000 [0084.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\hu\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0084.097] GetProcessHeap () returned 0x580000 [0084.097] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.097] GetProcessHeap () returned 0x580000 [0084.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\id\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0084.099] GetProcessHeap () returned 0x580000 [0084.099] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.099] GetProcessHeap () returned 0x580000 [0084.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\it\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0084.100] GetProcessHeap () returned 0x580000 [0084.100] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.100] GetProcessHeap () returned 0x580000 [0084.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ja\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0084.102] GetProcessHeap () returned 0x580000 [0084.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.102] GetProcessHeap () returned 0x580000 [0084.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\kk\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0084.104] GetProcessHeap () returned 0x580000 [0084.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.105] GetProcessHeap () returned 0x580000 [0084.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ko\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0084.109] GetProcessHeap () returned 0x580000 [0084.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.109] GetProcessHeap () returned 0x580000 [0084.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lt\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.111] GetProcessHeap () returned 0x580000 [0084.111] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.111] GetProcessHeap () returned 0x580000 [0084.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\lv\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0084.112] GetProcessHeap () returned 0x580000 [0084.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.113] GetProcessHeap () returned 0x580000 [0084.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ms\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0084.115] GetProcessHeap () returned 0x580000 [0084.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.115] GetProcessHeap () returned 0x580000 [0084.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\nl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0084.117] GetProcessHeap () returned 0x580000 [0084.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.117] GetProcessHeap () returned 0x580000 [0084.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\no\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0084.118] GetProcessHeap () returned 0x580000 [0084.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.118] GetProcessHeap () returned 0x580000 [0084.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0084.120] GetProcessHeap () returned 0x580000 [0084.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.120] GetProcessHeap () returned 0x580000 [0084.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.122] GetProcessHeap () returned 0x580000 [0084.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.122] GetProcessHeap () returned 0x580000 [0084.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\pt-PT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0084.123] GetProcessHeap () returned 0x580000 [0084.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.123] GetProcessHeap () returned 0x580000 [0084.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0084.124] GetProcessHeap () returned 0x580000 [0084.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1025\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf145ad52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0084.126] GetProcessHeap () returned 0x580000 [0084.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.126] GetProcessHeap () returned 0x580000 [0084.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1026\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0084.127] GetProcessHeap () returned 0x580000 [0084.127] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.127] GetProcessHeap () returned 0x580000 [0084.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\10266\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0084.256] GetProcessHeap () returned 0x580000 [0084.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.256] GetProcessHeap () returned 0x580000 [0084.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1027\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0084.256] GetProcessHeap () returned 0x580000 [0084.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.256] GetProcessHeap () returned 0x580000 [0084.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1028\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0084.256] GetProcessHeap () returned 0x580000 [0084.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.256] GetProcessHeap () returned 0x580000 [0084.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1029\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0084.257] GetProcessHeap () returned 0x580000 [0084.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.257] GetProcessHeap () returned 0x580000 [0084.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1030\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0084.257] GetProcessHeap () returned 0x580000 [0084.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.257] GetProcessHeap () returned 0x580000 [0084.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1031\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0084.258] GetProcessHeap () returned 0x580000 [0084.258] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.258] GetProcessHeap () returned 0x580000 [0084.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1032\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.259] GetProcessHeap () returned 0x580000 [0084.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.259] GetProcessHeap () returned 0x580000 [0084.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0084.259] GetProcessHeap () returned 0x580000 [0084.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.259] GetProcessHeap () returned 0x580000 [0084.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.259] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1035\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0084.261] GetProcessHeap () returned 0x580000 [0084.261] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.261] GetProcessHeap () returned 0x580000 [0084.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1036\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0084.261] GetProcessHeap () returned 0x580000 [0084.261] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.262] GetProcessHeap () returned 0x580000 [0084.262] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1037\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0084.262] GetProcessHeap () returned 0x580000 [0084.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.262] GetProcessHeap () returned 0x580000 [0084.262] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1038\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0084.263] GetProcessHeap () returned 0x580000 [0084.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.263] GetProcessHeap () returned 0x580000 [0084.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1040\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0084.264] GetProcessHeap () returned 0x580000 [0084.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.264] GetProcessHeap () returned 0x580000 [0084.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.264] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1041\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0084.264] GetProcessHeap () returned 0x580000 [0084.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.264] GetProcessHeap () returned 0x580000 [0084.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.264] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1042\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0084.265] GetProcessHeap () returned 0x580000 [0084.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.265] GetProcessHeap () returned 0x580000 [0084.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1043\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0084.265] GetProcessHeap () returned 0x580000 [0084.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.265] GetProcessHeap () returned 0x580000 [0084.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1044\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0084.268] GetProcessHeap () returned 0x580000 [0084.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.268] GetProcessHeap () returned 0x580000 [0084.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1045\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.268] GetProcessHeap () returned 0x580000 [0084.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.268] GetProcessHeap () returned 0x580000 [0084.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1046\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0084.269] GetProcessHeap () returned 0x580000 [0084.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.269] GetProcessHeap () returned 0x580000 [0084.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1048\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0084.279] GetProcessHeap () returned 0x580000 [0084.279] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.279] GetProcessHeap () returned 0x580000 [0084.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1049\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0084.280] GetProcessHeap () returned 0x580000 [0084.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.280] GetProcessHeap () returned 0x580000 [0084.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1050\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0084.280] GetProcessHeap () returned 0x580000 [0084.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.280] GetProcessHeap () returned 0x580000 [0084.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1051\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0084.280] GetProcessHeap () returned 0x580000 [0084.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.280] GetProcessHeap () returned 0x580000 [0084.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1053\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0084.281] GetProcessHeap () returned 0x580000 [0084.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.281] GetProcessHeap () returned 0x580000 [0084.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1054\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0084.281] GetProcessHeap () returned 0x580000 [0084.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.281] GetProcessHeap () returned 0x580000 [0084.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1055\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0084.282] GetProcessHeap () returned 0x580000 [0084.282] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.282] GetProcessHeap () returned 0x580000 [0084.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1057\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0084.282] GetProcessHeap () returned 0x580000 [0084.282] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.282] GetProcessHeap () returned 0x580000 [0084.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1058\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0084.283] GetProcessHeap () returned 0x580000 [0084.283] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.283] GetProcessHeap () returned 0x580000 [0084.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1060\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0084.283] GetProcessHeap () returned 0x580000 [0084.283] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.283] GetProcessHeap () returned 0x580000 [0084.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1061\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0084.284] GetProcessHeap () returned 0x580000 [0084.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.284] GetProcessHeap () returned 0x580000 [0084.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1062\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.284] GetProcessHeap () returned 0x580000 [0084.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.284] GetProcessHeap () returned 0x580000 [0084.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1063\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0084.284] GetProcessHeap () returned 0x580000 [0084.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.284] GetProcessHeap () returned 0x580000 [0084.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1066\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0084.349] GetProcessHeap () returned 0x580000 [0084.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.350] GetProcessHeap () returned 0x580000 [0084.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1069\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0084.361] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.361] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.361] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.361] FindClose (in: hFindFile=0x20029ee0 | out: hFindFile=0x20029ee0) returned 1 [0084.361] GetProcessHeap () returned 0x580000 [0084.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.361] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1081", cAlternateFileName="")) returned 1 [0084.361] GetProcessHeap () returned 0x580000 [0084.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1081\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0084.362] FindNextFileW (in: hFindFile=0x2002a1e0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.362] FindNextFileW (in: hFindFile=0x2002a1e0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.362] FindNextFileW (in: hFindFile=0x2002a1e0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.362] FindClose (in: hFindFile=0x2002a1e0 | out: hFindFile=0x2002a1e0) returned 1 [0084.362] GetProcessHeap () returned 0x580000 [0084.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.362] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1086", cAlternateFileName="")) returned 1 [0084.362] GetProcessHeap () returned 0x580000 [0084.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1086\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0084.363] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.363] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7abb0bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.363] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7abb0bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.363] FindClose (in: hFindFile=0x2002a220 | out: hFindFile=0x2002a220) returned 1 [0084.363] GetProcessHeap () returned 0x580000 [0084.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.363] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1087", cAlternateFileName="")) returned 1 [0084.363] GetProcessHeap () returned 0x580000 [0084.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1087\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.364] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.364] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.364] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11c60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.364] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0084.364] GetProcessHeap () returned 0x580000 [0084.364] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.364] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1110", cAlternateFileName="")) returned 1 [0084.364] GetProcessHeap () returned 0x580000 [0084.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\1110\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0084.365] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.365] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.365] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.365] FindClose (in: hFindFile=0x2002a360 | out: hFindFile=0x2002a360) returned 1 [0084.365] GetProcessHeap () returned 0x580000 [0084.365] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.365] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2052", cAlternateFileName="")) returned 1 [0084.365] GetProcessHeap () returned 0x580000 [0084.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2052\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0084.365] FindNextFileW (in: hFindFile=0x2002a260, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.365] FindNextFileW (in: hFindFile=0x2002a260, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.365] FindNextFileW (in: hFindFile=0x2002a260, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.365] FindClose (in: hFindFile=0x2002a260 | out: hFindFile=0x2002a260) returned 1 [0084.365] GetProcessHeap () returned 0x580000 [0084.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.366] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2070", cAlternateFileName="")) returned 1 [0084.366] GetProcessHeap () returned 0x580000 [0084.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2070\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0084.366] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.366] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.366] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.366] FindClose (in: hFindFile=0x20029fe0 | out: hFindFile=0x20029fe0) returned 1 [0084.366] GetProcessHeap () returned 0x580000 [0084.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.366] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2074", cAlternateFileName="")) returned 1 [0084.366] GetProcessHeap () returned 0x580000 [0084.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\2074\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0084.366] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.367] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.367] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x112c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.367] FindClose (in: hFindFile=0x20029ea0 | out: hFindFile=0x20029ea0) returned 1 [0084.367] GetProcessHeap () returned 0x580000 [0084.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.367] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0084.367] GetProcessHeap () returned 0x580000 [0084.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\3082\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0084.367] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.367] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.367] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.367] FindClose (in: hFindFile=0x20029e60 | out: hFindFile=0x20029e60) returned 1 [0084.367] GetProcessHeap () returned 0x580000 [0084.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.367] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9242", cAlternateFileName="")) returned 1 [0084.367] GetProcessHeap () returned 0x580000 [0084.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0084.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\Resources\\9242\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0084.368] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.368] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 1 [0084.368] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11860, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.rll", cAlternateFileName="POWERP~1.RLL")) returned 0 [0084.368] FindClose (in: hFindFile=0x2002a020 | out: hFindFile=0x2002a020) returned 1 [0084.368] GetProcessHeap () returned 0x580000 [0084.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0084.368] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9242", cAlternateFileName="")) returned 0 [0084.368] FindClose (in: hFindFile=0x20029d20 | out: hFindFile=0x20029d20) returned 1 [0084.368] GetProcessHeap () returned 0x580000 [0084.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.369] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0084.369] GetProcessHeap () returned 0x580000 [0084.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ro\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0084.370] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.370] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x110b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.370] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf15d84bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf16bd2da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.370] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xad2662, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xad2662, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf971d6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.370] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x443f20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x443f20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.370] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.370] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d4bb8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d4bb8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d71cd8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf035e09d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf035e09d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x92201bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x97c9c99, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd7bf89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb94fd84, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb94fd84, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb99c21f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c1f8d1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c1f8d1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c1f8d1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6034d6e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6034d6e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x605aed7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbe3ab3a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbe3ab3a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbe3ab3a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x70ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d9d08d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d9d08d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf755cb7d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x456248c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e78ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e78ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e78ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.371] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.371] FindClose (in: hFindFile=0x20029ea0 | out: hFindFile=0x20029ea0) returned 1 [0084.372] GetProcessHeap () returned 0x580000 [0084.372] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.372] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0084.372] GetProcessHeap () returned 0x580000 [0084.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\ru\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.373] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.373] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.373] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa39cfa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa39cfa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa39cfa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xcaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.373] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3143659, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3143659, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.373] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbda21cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbda21cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbda21cf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.373] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa2f5c0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa2f5c0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa2f5c0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x20c030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0084.373] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4abf9f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1945af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1945af2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42d8c51, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4d050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x49aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e0ae4d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e0ae4d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e310c7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8ae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9a05f3c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9a05f3c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a2c10c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf00af60a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1baa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6164f96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x75040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x384552e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x384552e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x605aed7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x605aed7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x613fd44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4640, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f2e583, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f2e583, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff580e7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.374] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff580e7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.374] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0084.375] GetProcessHeap () returned 0x580000 [0084.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.375] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0084.375] GetProcessHeap () returned 0x580000 [0084.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sk\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0084.376] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1152, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x78b299, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x78b299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x78b299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cd5a2f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cd5a2f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4cd5a2f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e7d566, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e7d566, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x200030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0084.376] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b9ee02, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7bc5054, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ca98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1dbe1c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1dbe1c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1dbe1c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12910b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12b7378, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5101cbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a04f26, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a04f26, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a04f26, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1a088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff580e7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0063153, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c66c57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c66c57, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7bc5054, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7bc5054, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bce2f5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.377] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.377] FindClose (in: hFindFile=0x2002a320 | out: hFindFile=0x2002a320) returned 1 [0084.378] GetProcessHeap () returned 0x580000 [0084.378] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.378] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0084.378] GetProcessHeap () returned 0x580000 [0084.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1095, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd7bf89, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39090, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d2b978, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fe030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf15d84bd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1697068, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d2b978, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5e43de4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5e43de4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6164f96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4bab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x47080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a0a7fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a0a7fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a30a43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69259a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69259a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0084.601] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6164f96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71088, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0084.602] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4110038, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4110038, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x447d6b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0084.602] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf126aeb1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf126aeb1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12b7378, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.602] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefe99511, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefebf763, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.602] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2fa0ca2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2fa0ca2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fa0ca2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0084.602] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.602] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.602] FindClose (in: hFindFile=0x20029e60 | out: hFindFile=0x20029e60) returned 1 [0084.603] GetProcessHeap () returned 0x580000 [0084.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.603] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0084.603] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0084.603] GetProcessHeap () returned 0x580000 [0084.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-cyrl\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0084.604] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaac403, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaac403, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1698075, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e78ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e78ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e78ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69259a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69259a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x694bc43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x718b80, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x718b80, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20b030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ab054a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ab054a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6164f96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x49aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6bae279, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x75068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x16068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0084.605] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x520cca6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0084.606] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffddb96c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffddb96c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffddb96c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4478, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0084.606] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b5bbeb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b5bbeb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b5bbeb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.606] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.606] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.606] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0084.606] GetProcessHeap () returned 0x580000 [0084.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.607] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0084.607] GetProcessHeap () returned 0x580000 [0084.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-latn\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0084.607] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc43098a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd028, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c895d2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4c895d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c895d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ff030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6cc6b6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6cc6b6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6cc6b6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a0a7fd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a0a7fd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a0a7fd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4bab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e4606, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9f15ef0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9f15ef0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x694bc43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x694bc43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6971e7c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb91216, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb91216, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf971d6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0084.608] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0dcc568, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.609] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x9888767, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9888767, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9888767, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0084.609] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf00d5872, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.609] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x897b914, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x897b914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91d3da7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0084.609] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.609] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.609] FindClose (in: hFindFile=0x2002a2a0 | out: hFindFile=0x2002a2a0) returned 1 [0084.609] GetProcessHeap () returned 0x580000 [0084.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.609] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0084.610] GetProcessHeap () returned 0x580000 [0084.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sr-Latn-CS\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0084.610] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.610] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x305f84a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x305f84a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36c7dee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd028, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67f4711, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67f4711, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67f4711, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39080, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d2a978, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d50bdc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fea98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d2a978, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6d2a978, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b78b8d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b78b8d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b9ee02, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a3ee57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a3ee57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e91324, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e310c7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e310c7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e572fe, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e7d566, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e7d566, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc5d437d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ac3a61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9bf4d66, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x70ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0063153, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a6473, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a6473, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0084.611] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4620012, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.612] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa937f07, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.612] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa937f07, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.612] FindClose (in: hFindFile=0x2002a460 | out: hFindFile=0x2002a460) returned 1 [0084.612] GetProcessHeap () returned 0x580000 [0084.612] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.612] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0084.612] GetProcessHeap () returned 0x580000 [0084.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\sv\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0084.613] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb654e78, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb654e78, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb67b102, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cfbc75, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cfbc75, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23428c3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x23428c3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1fda98, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf145ad52, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf145ad52, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf158c060, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3f7b55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3f7b55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d038, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3f7b55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3f7b55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7582db3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7582db3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4c050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x46ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42fef17, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf43250ed, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5478, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2ff666, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2ff666, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2ff666, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13058, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1697068, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf16bd2da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf02eb98a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf02eb98a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.614] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c63313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4c63313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c895d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0084.615] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0084.615] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6ac83cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6ac83cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0084.615] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae22cc9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0084.615] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e68, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.615] FindNextFileW (in: hFindFile=0x20029de0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e68, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.615] FindClose (in: hFindFile=0x20029de0 | out: hFindFile=0x20029de0) returned 1 [0084.615] GetProcessHeap () returned 0x580000 [0084.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.616] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0084.616] GetProcessHeap () returned 0x580000 [0084.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\th\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1681b941, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176b, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x637c06e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x637c06e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x637c06e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffddb96c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffddb96c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffddb96c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0df27d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x18030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf3b191de, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3b191de, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf3b3f424, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x216030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f76153, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f76153, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf016e209, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf016e209, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x26040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0084.617] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6bae279, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x61fe8c4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x61fe8c4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61fe8c4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf07af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf07af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf2dd35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4d060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ac3a61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6c78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefebf763, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69259a9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69259a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1daa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MIC811~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0dcc568, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x76aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf43e3cb7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4409f1c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MI5C38~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x680214, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4878, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0084.618] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0 [0084.618] FindClose (in: hFindFile=0x2002a020 | out: hFindFile=0x2002a020) returned 1 [0084.619] GetProcessHeap () returned 0x580000 [0084.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.619] FindNextFileW (in: hFindFile=0x20029fa0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0084.619] GetProcessHeap () returned 0x580000 [0084.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\tr\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16867e02, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xca90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.resources.dll", cAlternateFileName="MIE3DA~1.DLL")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d05722, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x681a969, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x681a969, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6840bbc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b9ee02, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7bc5054, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1ff030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc5ae112, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc5ae112, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc5d437d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x996d62b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d030, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MI93CC~1.DLL")) returned 1 [0084.620] FindNextFileW (in: hFindFile=0x2002a2a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x28c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1 [0084.623] GetProcessHeap () returned 0x580000 [0084.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.623] GetProcessHeap () returned 0x580000 [0084.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.623] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0084.624] GetProcessHeap () returned 0x580000 [0084.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.625] GetProcessHeap () returned 0x580000 [0084.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0084.626] GetProcessHeap () returned 0x580000 [0084.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.626] GetProcessHeap () returned 0x580000 [0084.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHS\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0084.628] GetProcessHeap () returned 0x580000 [0084.628] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.628] GetProcessHeap () returned 0x580000 [0084.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0084.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\zh-CHT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0084.630] GetProcessHeap () returned 0x580000 [0084.630] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0084.630] GetProcessHeap () returned 0x580000 [0084.630] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0084.630] GetProcessHeap () returned 0x580000 [0084.630] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0084.631] GetProcessHeap () returned 0x580000 [0084.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0084.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17728794, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17728794, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0084.631] GetProcessHeap () returned 0x580000 [0084.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0084.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Sort\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x176dc2d0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0085.052] GetProcessHeap () returned 0x580000 [0085.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.053] GetProcessHeap () returned 0x580000 [0085.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.053] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Bibliography\\Style\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0085.055] GetProcessHeap () returned 0x580000 [0085.055] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.055] GetProcessHeap () returned 0x580000 [0085.055] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.055] GetProcessHeap () returned 0x580000 [0085.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\BORDERS\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0085.058] GetProcessHeap () returned 0x580000 [0085.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.058] GetProcessHeap () returned 0x580000 [0085.058] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Configuration\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1774e9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1774e9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0085.060] GetProcessHeap () returned 0x580000 [0085.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.060] GetProcessHeap () returned 0x580000 [0085.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0085.061] GetProcessHeap () returned 0x580000 [0085.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\CONVERT\\1033\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec4ee541, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cd4a32, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.063] GetProcessHeap () returned 0x580000 [0085.063] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.063] GetProcessHeap () returned 0x580000 [0085.063] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.063] GetProcessHeap () returned 0x580000 [0085.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.064] GetProcessHeap () returned 0x580000 [0085.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0085.064] GetProcessHeap () returned 0x580000 [0085.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Document Parts\\1033\\16\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0085.064] GetProcessHeap () returned 0x580000 [0085.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.065] GetProcessHeap () returned 0x580000 [0085.065] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.065] GetProcessHeap () returned 0x580000 [0085.065] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.067] GetProcessHeap () returned 0x580000 [0085.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca90ec5a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca90ec5a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.068] GetProcessHeap () returned 0x580000 [0085.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\FORMS\\1033\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0085.072] GetProcessHeap () returned 0x580000 [0085.072] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.072] GetProcessHeap () returned 0x580000 [0085.072] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.072] GetProcessHeap () returned 0x580000 [0085.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0085.073] GetProcessHeap () returned 0x580000 [0085.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ff3259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x186355ca, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x186355ca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0085.073] GetProcessHeap () returned 0x580000 [0085.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.073] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.074] GetProcessHeap () returned 0x580000 [0085.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Components\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18aadbcf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18aadbcf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18aadbcf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.075] GetProcessHeap () returned 0x580000 [0085.075] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.075] GetProcessHeap () returned 0x580000 [0085.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.075] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\ManagedObjects\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0085.076] GetProcessHeap () returned 0x580000 [0085.076] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.076] GetProcessHeap () returned 0x580000 [0085.076] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\groove.net\\Servers\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0085.076] GetProcessHeap () returned 0x580000 [0085.076] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.076] GetProcessHeap () returned 0x580000 [0085.076] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.077] GetProcessHeap () returned 0x580000 [0085.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.077] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.077] GetProcessHeap () returned 0x580000 [0085.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Certificates\\Verisign\\Components\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0085.080] GetProcessHeap () returned 0x580000 [0085.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.080] GetProcessHeap () returned 0x580000 [0085.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.080] GetProcessHeap () returned 0x580000 [0085.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.081] GetProcessHeap () returned 0x580000 [0085.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0085.081] GetProcessHeap () returned 0x580000 [0085.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\People\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a3b641, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197321ed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197321ed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0085.084] GetProcessHeap () returned 0x580000 [0085.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.084] GetProcessHeap () returned 0x580000 [0085.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.084] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Places\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0085.086] GetProcessHeap () returned 0x580000 [0085.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.086] GetProcessHeap () returned 0x580000 [0085.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\Sounds\\Things\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0085.089] GetProcessHeap () returned 0x580000 [0085.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.089] GetProcessHeap () returned 0x580000 [0085.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.089] GetProcessHeap () returned 0x580000 [0085.089] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolBMPs\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0085.194] GetProcessHeap () returned 0x580000 [0085.194] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.194] GetProcessHeap () returned 0x580000 [0085.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.194] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.195] GetProcessHeap () returned 0x580000 [0085.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.195] GetProcessHeap () returned 0x580000 [0085.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.196] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\CommonData\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198afa29, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0085.198] GetProcessHeap () returned 0x580000 [0085.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.198] GetProcessHeap () returned 0x580000 [0085.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolData\\groove.net\\Computers\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0085.199] GetProcessHeap () returned 0x580000 [0085.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.199] GetProcessHeap () returned 0x580000 [0085.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.200] GetProcessHeap () returned 0x580000 [0085.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.200] GetProcessHeap () returned 0x580000 [0085.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Groove\\ToolIcons\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.202] GetProcessHeap () returned 0x580000 [0085.202] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.202] GetProcessHeap () returned 0x580000 [0085.202] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.203] GetProcessHeap () returned 0x580000 [0085.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x19889710, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0085.204] GetProcessHeap () returned 0x580000 [0085.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\Analysis\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xafa146a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.206] GetProcessHeap () returned 0x580000 [0085.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.206] GetProcessHeap () returned 0x580000 [0085.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Library\\SOLVER\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0085.206] GetProcessHeap () returned 0x580000 [0085.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.206] GetProcessHeap () returned 0x580000 [0085.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.206] GetProcessHeap () returned 0x580000 [0085.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\LogoImages\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0085.242] GetProcessHeap () returned 0x580000 [0085.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.243] GetProcessHeap () returned 0x580000 [0085.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.243] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Media\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b22ac67, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b22ac67, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0085.249] GetProcessHeap () returned 0x580000 [0085.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.250] GetProcessHeap () returned 0x580000 [0085.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b3a83c3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b3a83c3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0085.251] GetProcessHeap () returned 0x580000 [0085.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ar\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99462e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99462e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99462e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.251] GetProcessHeap () returned 0x580000 [0085.251] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.251] GetProcessHeap () returned 0x580000 [0085.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.251] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\bg\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.445] GetProcessHeap () returned 0x580000 [0085.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.446] GetProcessHeap () returned 0x580000 [0085.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ca\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0085.446] GetProcessHeap () returned 0x580000 [0085.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.446] GetProcessHeap () returned 0x580000 [0085.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\cs\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.447] GetProcessHeap () returned 0x580000 [0085.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.447] GetProcessHeap () returned 0x580000 [0085.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\da\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0085.447] GetProcessHeap () returned 0x580000 [0085.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.447] GetProcessHeap () returned 0x580000 [0085.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\de\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0085.447] GetProcessHeap () returned 0x580000 [0085.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.447] GetProcessHeap () returned 0x580000 [0085.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\el\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0085.448] GetProcessHeap () returned 0x580000 [0085.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.448] GetProcessHeap () returned 0x580000 [0085.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\en-us\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0085.448] GetProcessHeap () returned 0x580000 [0085.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.449] GetProcessHeap () returned 0x580000 [0085.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\es\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0085.449] GetProcessHeap () returned 0x580000 [0085.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.449] GetProcessHeap () returned 0x580000 [0085.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\et\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0085.450] GetProcessHeap () returned 0x580000 [0085.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.450] GetProcessHeap () returned 0x580000 [0085.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\eu\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0085.450] GetProcessHeap () returned 0x580000 [0085.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.450] GetProcessHeap () returned 0x580000 [0085.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.450] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fi\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0085.450] GetProcessHeap () returned 0x580000 [0085.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.450] GetProcessHeap () returned 0x580000 [0085.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\fr\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.451] GetProcessHeap () returned 0x580000 [0085.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.451] GetProcessHeap () returned 0x580000 [0085.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\gl\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0085.451] GetProcessHeap () returned 0x580000 [0085.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.451] GetProcessHeap () returned 0x580000 [0085.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\he\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0085.452] GetProcessHeap () returned 0x580000 [0085.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.452] GetProcessHeap () returned 0x580000 [0085.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.452] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hi\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0085.453] GetProcessHeap () returned 0x580000 [0085.453] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.453] GetProcessHeap () returned 0x580000 [0085.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hr\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0085.453] GetProcessHeap () returned 0x580000 [0085.453] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.453] GetProcessHeap () returned 0x580000 [0085.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.453] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\hu\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0085.454] GetProcessHeap () returned 0x580000 [0085.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.454] GetProcessHeap () returned 0x580000 [0085.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\id\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.454] GetProcessHeap () returned 0x580000 [0085.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.454] GetProcessHeap () returned 0x580000 [0085.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.454] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\it\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b433, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x59b433, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59b433, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.455] GetProcessHeap () returned 0x580000 [0085.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.455] GetProcessHeap () returned 0x580000 [0085.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ja\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0085.455] GetProcessHeap () returned 0x580000 [0085.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.455] GetProcessHeap () returned 0x580000 [0085.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.455] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\kk\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0085.456] GetProcessHeap () returned 0x580000 [0085.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.456] GetProcessHeap () returned 0x580000 [0085.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ko\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0085.456] GetProcessHeap () returned 0x580000 [0085.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.456] GetProcessHeap () returned 0x580000 [0085.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lt\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0085.456] GetProcessHeap () returned 0x580000 [0085.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.456] GetProcessHeap () returned 0x580000 [0085.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.456] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\lv\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0085.457] GetProcessHeap () returned 0x580000 [0085.457] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.457] GetProcessHeap () returned 0x580000 [0085.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ms\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.457] GetProcessHeap () returned 0x580000 [0085.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.458] GetProcessHeap () returned 0x580000 [0085.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\nl\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf2dd35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf2dd35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf2dd35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0085.458] GetProcessHeap () returned 0x580000 [0085.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.458] GetProcessHeap () returned 0x580000 [0085.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\no\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0085.459] GetProcessHeap () returned 0x580000 [0085.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.459] GetProcessHeap () returned 0x580000 [0085.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.459] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pl\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.459] GetProcessHeap () returned 0x580000 [0085.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.460] GetProcessHeap () returned 0x580000 [0085.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0085.460] GetProcessHeap () returned 0x580000 [0085.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.460] GetProcessHeap () returned 0x580000 [0085.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.460] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\pt-BR\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0085.460] GetProcessHeap () returned 0x580000 [0085.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.461] GetProcessHeap () returned 0x580000 [0085.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ro\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0085.461] GetProcessHeap () returned 0x580000 [0085.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.461] GetProcessHeap () returned 0x580000 [0085.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\ru\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0085.461] GetProcessHeap () returned 0x580000 [0085.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.461] GetProcessHeap () returned 0x580000 [0085.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sk\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0085.461] GetProcessHeap () returned 0x580000 [0085.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.461] GetProcessHeap () returned 0x580000 [0085.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sl\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0085.462] GetProcessHeap () returned 0x580000 [0085.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.462] GetProcessHeap () returned 0x580000 [0085.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-BA\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0085.462] GetProcessHeap () returned 0x580000 [0085.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.462] GetProcessHeap () returned 0x580000 [0085.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Cyrl-CS\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.462] GetProcessHeap () returned 0x580000 [0085.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.462] GetProcessHeap () returned 0x580000 [0085.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sr-Latn-CS\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.463] GetProcessHeap () returned 0x580000 [0085.463] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.463] GetProcessHeap () returned 0x580000 [0085.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\sv\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.463] GetProcessHeap () returned 0x580000 [0085.463] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.463] GetProcessHeap () returned 0x580000 [0085.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\th\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.464] GetProcessHeap () returned 0x580000 [0085.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.464] GetProcessHeap () returned 0x580000 [0085.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\tr\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0085.464] GetProcessHeap () returned 0x580000 [0085.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.464] GetProcessHeap () returned 0x580000 [0085.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.464] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\uk\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0085.464] GetProcessHeap () returned 0x580000 [0085.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.465] GetProcessHeap () returned 0x580000 [0085.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\vi\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0085.465] GetProcessHeap () returned 0x580000 [0085.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.465] GetProcessHeap () returned 0x580000 [0085.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.465] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-CN\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0085.466] GetProcessHeap () returned 0x580000 [0085.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.466] GetProcessHeap () returned 0x580000 [0085.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\MSIPC\\zh-TW\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0085.466] GetProcessHeap () returned 0x580000 [0085.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.466] GetProcessHeap () returned 0x580000 [0085.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.468] GetProcessHeap () returned 0x580000 [0085.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OneNote\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1c8ab024, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1c8ab024, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0085.469] GetProcessHeap () returned 0x580000 [0085.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.469] GetProcessHeap () returned 0x580000 [0085.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\OutlookAutoDiscover\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc86400, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc86400, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.478] GetProcessHeap () returned 0x580000 [0085.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.478] GetProcessHeap () returned 0x580000 [0085.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PAGESIZE\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc348b22, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1fc39fa2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1fc39fa2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0085.482] GetProcessHeap () returned 0x580000 [0085.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.482] GetProcessHeap () returned 0x580000 [0085.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.482] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc39bed4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb0d2731, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb0d2731, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.483] GetProcessHeap () returned 0x580000 [0085.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1033\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0085.484] GetProcessHeap () returned 0x580000 [0085.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.484] GetProcessHeap () returned 0x580000 [0085.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1036\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.484] GetProcessHeap () returned 0x580000 [0085.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.484] GetProcessHeap () returned 0x580000 [0085.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\3082\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0085.484] GetProcessHeap () returned 0x580000 [0085.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.484] GetProcessHeap () returned 0x580000 [0085.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.485] GetProcessHeap () returned 0x580000 [0085.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.485] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBBA\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0085.486] GetProcessHeap () returned 0x580000 [0085.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.487] GetProcessHeap () returned 0x580000 [0085.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\PUBWIZ\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc3bb225, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x241382dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x241382dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0085.618] GetProcessHeap () returned 0x580000 [0085.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.618] GetProcessHeap () returned 0x580000 [0085.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\QUERIES\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0085.619] GetProcessHeap () returned 0x580000 [0085.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.619] GetProcessHeap () returned 0x580000 [0085.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\SAMPLES\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0085.619] GetProcessHeap () returned 0x580000 [0085.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.619] GetProcessHeap () returned 0x580000 [0085.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\STARTUP\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0085.619] GetProcessHeap () returned 0x580000 [0085.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.620] GetProcessHeap () returned 0x580000 [0085.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0xa326fd, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0xa326fd, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0085.621] GetProcessHeap () returned 0x580000 [0085.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\Visio Content\\1033\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0085.945] GetProcessHeap () returned 0x580000 [0085.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.945] GetProcessHeap () returned 0x580000 [0085.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.946] GetProcessHeap () returned 0x580000 [0085.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\XLSTART\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.946] GetProcessHeap () returned 0x580000 [0085.946] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.946] GetProcessHeap () returned 0x580000 [0085.946] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0085.947] GetProcessHeap () returned 0x580000 [0085.947] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0085.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\rsod\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.952] GetProcessHeap () returned 0x580000 [0085.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0085.953] GetProcessHeap () returned 0x580000 [0085.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0085.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0085.953] GetProcessHeap () returned 0x580000 [0085.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.955] GetProcessHeap () returned 0x580000 [0085.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.955] GetProcessHeap () returned 0x580000 [0085.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0085.956] GetProcessHeap () returned 0x580000 [0085.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0085.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0085.956] GetProcessHeap () returned 0x580000 [0085.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb571036, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0085.959] GetProcessHeap () returned 0x580000 [0085.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb5bd4f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb5bd4f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0085.960] GetProcessHeap () returned 0x580000 [0085.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.960] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\DataType\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5972d3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb62fbf7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb62fbf7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0085.962] GetProcessHeap () returned 0x580000 [0085.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.962] GetProcessHeap () returned 0x580000 [0085.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\Access\\Part\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0085.965] GetProcessHeap () returned 0x580000 [0085.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.965] GetProcessHeap () returned 0x580000 [0085.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.965] GetProcessHeap () returned 0x580000 [0085.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\GettingStarted16\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e332373, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e332373, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e332373, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0085.969] GetProcessHeap () returned 0x580000 [0085.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.969] GetProcessHeap () returned 0x580000 [0085.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0085.970] GetProcessHeap () returned 0x580000 [0085.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0085.970] GetProcessHeap () returned 0x580000 [0085.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Notebook Templates\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0085.971] GetProcessHeap () returned 0x580000 [0085.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.972] GetProcessHeap () returned 0x580000 [0085.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\1033\\ONENOTE\\16\\Stationery\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0085.972] GetProcessHeap () returned 0x580000 [0085.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.972] GetProcessHeap () returned 0x580000 [0085.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.972] GetProcessHeap () returned 0x580000 [0085.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.973] GetProcessHeap () returned 0x580000 [0085.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.973] GetProcessHeap () returned 0x580000 [0085.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Templates\\Presentation Designs\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0085.975] GetProcessHeap () returned 0x580000 [0085.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0085.975] GetProcessHeap () returned 0x580000 [0085.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0085.976] GetProcessHeap () returned 0x580000 [0085.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0085.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0085.977] GetProcessHeap () returned 0x580000 [0085.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0085.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0085.978] GetProcessHeap () returned 0x580000 [0085.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0085.978] GetProcessHeap () returned 0x580000 [0085.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9f15ef0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0085.980] GetProcessHeap () returned 0x580000 [0085.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0085.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\OFFICE\\Heartbeat\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2e5eac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2e5eac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2e5eac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0085.981] GetProcessHeap () returned 0x580000 [0085.981] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0085.981] GetProcessHeap () returned 0x580000 [0085.981] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.981] GetProcessHeap () returned 0x580000 [0085.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0085.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft\\VISIO\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0085.982] GetProcessHeap () returned 0x580000 [0085.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0085.982] GetProcessHeap () returned 0x580000 [0085.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0085.983] GetProcessHeap () returned 0x580000 [0085.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0085.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common AppData\\Microsoft Help\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0086.102] GetProcessHeap () returned 0x580000 [0086.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.102] GetProcessHeap () returned 0x580000 [0086.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0086.102] GetProcessHeap () returned 0x580000 [0086.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0086.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0086.104] GetProcessHeap () returned 0x580000 [0086.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Common Programs\\Microsoft Office 2016 Tools\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0086.106] GetProcessHeap () returned 0x580000 [0086.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.106] GetProcessHeap () returned 0x580000 [0086.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0086.106] GetProcessHeap () returned 0x580000 [0086.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0086.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.106] GetProcessHeap () returned 0x580000 [0086.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Fonts\\private\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0086.112] GetProcessHeap () returned 0x580000 [0086.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.112] GetProcessHeap () returned 0x580000 [0086.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0086.112] GetProcessHeap () returned 0x580000 [0086.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0086.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0086.113] GetProcessHeap () returned 0x580000 [0086.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\DESIGNER\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb975fdf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb975fdf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb975fdf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0086.113] GetProcessHeap () returned 0x580000 [0086.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.113] GetProcessHeap () returned 0x580000 [0086.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0086.114] GetProcessHeap () returned 0x580000 [0086.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x246bb96e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x246bb96e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.116] GetProcessHeap () returned 0x580000 [0086.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\DW\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf477755d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf477755d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf47e9c8f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.117] GetProcessHeap () returned 0x580000 [0086.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0086.117] GetProcessHeap () returned 0x580000 [0086.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.117] GetProcessHeap () returned 0x580000 [0086.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0086.119] GetProcessHeap () returned 0x580000 [0086.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4620012, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4620012, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4620012, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.119] GetProcessHeap () returned 0x580000 [0086.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0086.119] GetProcessHeap () returned 0x580000 [0086.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.119] GetProcessHeap () returned 0x580000 [0086.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EURO\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0086.120] GetProcessHeap () returned 0x580000 [0086.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.120] GetProcessHeap () returned 0x580000 [0086.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Filters\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0086.120] GetProcessHeap () returned 0x580000 [0086.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.120] GetProcessHeap () returned 0x580000 [0086.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0086.122] GetProcessHeap () returned 0x580000 [0086.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.122] GetProcessHeap () returned 0x580000 [0086.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Help\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0086.124] GetProcessHeap () returned 0x580000 [0086.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.124] GetProcessHeap () returned 0x580000 [0086.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0086.125] GetProcessHeap () returned 0x580000 [0086.125] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.125] GetProcessHeap () returned 0x580000 [0086.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0086.126] GetProcessHeap () returned 0x580000 [0086.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc541ed37, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb99d23b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb99d23b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.128] GetProcessHeap () returned 0x580000 [0086.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0086.128] GetProcessHeap () returned 0x580000 [0086.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc461cf97, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc461cf97, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc461cf97, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0086.128] GetProcessHeap () returned 0x580000 [0086.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0086.128] GetProcessHeap () returned 0x580000 [0086.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.129] GetProcessHeap () returned 0x580000 [0086.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Cartridges\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24bcc96d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24d70354, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24d70354, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0086.131] GetProcessHeap () returned 0x580000 [0086.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.131] GetProcessHeap () returned 0x580000 [0086.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0086.133] GetProcessHeap () returned 0x580000 [0086.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\DataModel\\Resources\\1033\\*", lpFindFileData=0x1fb9e340 | out: lpFindFileData=0x1fb9e340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.134] GetProcessHeap () returned 0x580000 [0086.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.134] GetProcessHeap () returned 0x580000 [0086.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.134] GetProcessHeap () returned 0x580000 [0086.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0086.135] GetProcessHeap () returned 0x580000 [0086.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.135] GetProcessHeap () returned 0x580000 [0086.135] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0086.135] GetProcessHeap () returned 0x580000 [0086.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0086.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xef915def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef915def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.136] GetProcessHeap () returned 0x580000 [0086.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0086.136] GetProcessHeap () returned 0x580000 [0086.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.136] GetProcessHeap () returned 0x580000 [0086.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0086.137] GetProcessHeap () returned 0x580000 [0086.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.137] GetProcessHeap () returned 0x580000 [0086.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0086.137] GetProcessHeap () returned 0x580000 [0086.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.138] GetProcessHeap () returned 0x580000 [0086.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.534] GetProcessHeap () returned 0x580000 [0086.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf07b04e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf07b04e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.534] GetProcessHeap () returned 0x580000 [0086.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.534] GetProcessHeap () returned 0x580000 [0086.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0086.535] GetProcessHeap () returned 0x580000 [0086.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc883e0d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc883e0d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0086.535] GetProcessHeap () returned 0x580000 [0086.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.535] GetProcessHeap () returned 0x580000 [0086.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.536] GetProcessHeap () returned 0x580000 [0086.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.536] GetProcessHeap () returned 0x580000 [0086.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0086.576] GetProcessHeap () returned 0x580000 [0086.576] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.576] GetProcessHeap () returned 0x580000 [0086.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.576] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.577] GetProcessHeap () returned 0x580000 [0086.577] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.577] GetProcessHeap () returned 0x580000 [0086.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.577] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0086.578] GetProcessHeap () returned 0x580000 [0086.578] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AFTRNOON\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bfc670, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.579] GetProcessHeap () returned 0x580000 [0086.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.579] GetProcessHeap () returned 0x580000 [0086.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ARCTIC\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0086.580] GetProcessHeap () returned 0x580000 [0086.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.580] GetProcessHeap () returned 0x580000 [0086.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\AXIS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0086.580] GetProcessHeap () returned 0x580000 [0086.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.580] GetProcessHeap () returned 0x580000 [0086.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLENDS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0086.581] GetProcessHeap () returned 0x580000 [0086.581] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.581] GetProcessHeap () returned 0x580000 [0086.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUECALM\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0086.581] GetProcessHeap () returned 0x580000 [0086.581] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.581] GetProcessHeap () returned 0x580000 [0086.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BLUEPRNT\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0086.582] GetProcessHeap () returned 0x580000 [0086.582] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.582] GetProcessHeap () returned 0x580000 [0086.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.582] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BOLDSTRI\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.583] GetProcessHeap () returned 0x580000 [0086.583] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.583] GetProcessHeap () returned 0x580000 [0086.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\BREEZE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.583] GetProcessHeap () returned 0x580000 [0086.583] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.583] GetProcessHeap () returned 0x580000 [0086.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CANYON\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.584] GetProcessHeap () returned 0x580000 [0086.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.584] GetProcessHeap () returned 0x580000 [0086.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CAPSULES\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0086.584] GetProcessHeap () returned 0x580000 [0086.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.585] GetProcessHeap () returned 0x580000 [0086.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CASCADE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0086.585] GetProcessHeap () returned 0x580000 [0086.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.585] GetProcessHeap () returned 0x580000 [0086.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\COMPASS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0086.586] GetProcessHeap () returned 0x580000 [0086.586] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.586] GetProcessHeap () returned 0x580000 [0086.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\CONCRETE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.587] GetProcessHeap () returned 0x580000 [0086.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.587] GetProcessHeap () returned 0x580000 [0086.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\DEEPBLUE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.587] GetProcessHeap () returned 0x580000 [0086.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.587] GetProcessHeap () returned 0x580000 [0086.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECHO\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.588] GetProcessHeap () returned 0x580000 [0086.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.588] GetProcessHeap () returned 0x580000 [0086.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ECLIPSE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0086.590] GetProcessHeap () returned 0x580000 [0086.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.590] GetProcessHeap () returned 0x580000 [0086.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EDGE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.590] GetProcessHeap () returned 0x580000 [0086.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.590] GetProcessHeap () returned 0x580000 [0086.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EVRGREEN\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.591] GetProcessHeap () returned 0x580000 [0086.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.591] GetProcessHeap () returned 0x580000 [0086.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\EXPEDITN\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.591] GetProcessHeap () returned 0x580000 [0086.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.591] GetProcessHeap () returned 0x580000 [0086.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\ICE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0086.592] GetProcessHeap () returned 0x580000 [0086.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.592] GetProcessHeap () returned 0x580000 [0086.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\INDUST\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0086.593] GetProcessHeap () returned 0x580000 [0086.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.593] GetProcessHeap () returned 0x580000 [0086.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\IRIS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0086.593] GetProcessHeap () returned 0x580000 [0086.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.593] GetProcessHeap () returned 0x580000 [0086.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\JOURNAL\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0086.594] GetProcessHeap () returned 0x580000 [0086.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.594] GetProcessHeap () returned 0x580000 [0086.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LAYERS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.594] GetProcessHeap () returned 0x580000 [0086.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.594] GetProcessHeap () returned 0x580000 [0086.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\LEVEL\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0086.594] GetProcessHeap () returned 0x580000 [0086.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.595] GetProcessHeap () returned 0x580000 [0086.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\NETWORK\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.595] GetProcessHeap () returned 0x580000 [0086.595] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.595] GetProcessHeap () returned 0x580000 [0086.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PAPYRUS\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.596] GetProcessHeap () returned 0x580000 [0086.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.596] GetProcessHeap () returned 0x580000 [0086.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PIXEL\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0086.596] GetProcessHeap () returned 0x580000 [0086.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.596] GetProcessHeap () returned 0x580000 [0086.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\PROFILE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.597] GetProcessHeap () returned 0x580000 [0086.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.597] GetProcessHeap () returned 0x580000 [0086.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\QUAD\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.597] GetProcessHeap () returned 0x580000 [0086.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.597] GetProcessHeap () returned 0x580000 [0086.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RADIAL\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.598] GetProcessHeap () returned 0x580000 [0086.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.598] GetProcessHeap () returned 0x580000 [0086.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\REFINED\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0086.599] GetProcessHeap () returned 0x580000 [0086.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.599] GetProcessHeap () returned 0x580000 [0086.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RICEPAPR\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0086.601] GetProcessHeap () returned 0x580000 [0086.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.602] GetProcessHeap () returned 0x580000 [0086.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RIPPLE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0086.602] GetProcessHeap () returned 0x580000 [0086.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.602] GetProcessHeap () returned 0x580000 [0086.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\RMNSQUE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0086.603] GetProcessHeap () returned 0x580000 [0086.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.603] GetProcessHeap () returned 0x580000 [0086.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SATIN\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0086.604] GetProcessHeap () returned 0x580000 [0086.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.604] GetProcessHeap () returned 0x580000 [0086.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SKY\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0086.604] GetProcessHeap () returned 0x580000 [0086.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.604] GetProcessHeap () returned 0x580000 [0086.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SLATE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0086.605] GetProcessHeap () returned 0x580000 [0086.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.605] GetProcessHeap () returned 0x580000 [0086.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SONORA\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.606] GetProcessHeap () returned 0x580000 [0086.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.606] GetProcessHeap () returned 0x580000 [0086.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SPRING\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.607] GetProcessHeap () returned 0x580000 [0086.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.607] GetProcessHeap () returned 0x580000 [0086.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STRTEDGE\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0086.607] GetProcessHeap () returned 0x580000 [0086.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.607] GetProcessHeap () returned 0x580000 [0086.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\STUDIO\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.608] GetProcessHeap () returned 0x580000 [0086.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.608] GetProcessHeap () returned 0x580000 [0086.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\SUMIPNTG\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0086.609] GetProcessHeap () returned 0x580000 [0086.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.609] GetProcessHeap () returned 0x580000 [0086.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATER\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0086.609] GetProcessHeap () returned 0x580000 [0086.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.609] GetProcessHeap () returned 0x580000 [0086.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\THEMES16\\WATERMAR\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0086.610] GetProcessHeap () returned 0x580000 [0086.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.610] GetProcessHeap () returned 0x580000 [0086.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.611] GetProcessHeap () returned 0x580000 [0086.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0086.613] GetProcessHeap () returned 0x580000 [0086.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENES\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc85db99, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc85db99, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc883e0d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0086.614] GetProcessHeap () returned 0x580000 [0086.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.614] GetProcessHeap () returned 0x580000 [0086.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ENFR\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0086.614] GetProcessHeap () returned 0x580000 [0086.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.614] GetProcessHeap () returned 0x580000 [0086.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\ESEN\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.615] GetProcessHeap () returned 0x580000 [0086.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.615] GetProcessHeap () returned 0x580000 [0086.615] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TRANSLAT\\FREN\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0086.615] GetProcessHeap () returned 0x580000 [0086.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.615] GetProcessHeap () returned 0x580000 [0086.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.616] GetProcessHeap () returned 0x580000 [0086.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0086.617] GetProcessHeap () returned 0x580000 [0086.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.617] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.617] GetProcessHeap () returned 0x580000 [0086.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb4d4679, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcb4d4679, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xecf3682d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0086.618] GetProcessHeap () returned 0x580000 [0086.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.618] GetProcessHeap () returned 0x580000 [0086.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.618] GetProcessHeap () returned 0x580000 [0086.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.619] GetProcessHeap () returned 0x580000 [0086.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0086.620] GetProcessHeap () returned 0x580000 [0086.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Visio Shared\\Fonts\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.773] GetProcessHeap () returned 0x580000 [0086.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.774] GetProcessHeap () returned 0x580000 [0086.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.774] GetProcessHeap () returned 0x580000 [0086.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0086.775] GetProcessHeap () returned 0x580000 [0086.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0086.775] GetProcessHeap () returned 0x580000 [0086.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0086.776] GetProcessHeap () returned 0x580000 [0086.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203c0060 [0086.776] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\1033\\*", lpFindFileData=0x1fb9e340 | out: lpFindFileData=0x1fb9e340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca27806, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.777] GetProcessHeap () returned 0x580000 [0086.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203c0060 | out: hHeap=0x580000) returned 1 [0086.777] GetProcessHeap () returned 0x580000 [0086.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.777] GetProcessHeap () returned 0x580000 [0086.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.777] GetProcessHeap () returned 0x580000 [0086.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.778] GetProcessHeap () returned 0x580000 [0086.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.778] GetProcessHeap () returned 0x580000 [0086.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.779] GetProcessHeap () returned 0x580000 [0086.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\ODBC\\Data Sources\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0086.779] GetProcessHeap () returned 0x580000 [0086.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.779] GetProcessHeap () returned 0x580000 [0086.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.780] GetProcessHeap () returned 0x580000 [0086.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.780] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0086.782] GetProcessHeap () returned 0x580000 [0086.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0086.783] GetProcessHeap () returned 0x580000 [0086.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.783] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\MSMAPI\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0086.783] GetProcessHeap () returned 0x580000 [0086.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.784] GetProcessHeap () returned 0x580000 [0086.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.784] GetProcessHeap () returned 0x580000 [0086.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.785] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\SYSTEM\\ole db\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0086.785] GetProcessHeap () returned 0x580000 [0086.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.785] GetProcessHeap () returned 0x580000 [0086.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.785] GetProcessHeap () returned 0x580000 [0086.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0086.786] GetProcessHeap () returned 0x580000 [0086.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0086.786] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0086.786] GetProcessHeap () returned 0x580000 [0086.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.787] GetProcessHeap () returned 0x580000 [0086.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0086.790] GetProcessHeap () returned 0x580000 [0086.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.790] GetProcessHeap () returned 0x580000 [0086.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0086.791] GetProcessHeap () returned 0x580000 [0086.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1028\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12dd5ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0086.792] GetProcessHeap () returned 0x580000 [0086.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.792] GetProcessHeap () returned 0x580000 [0086.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1031\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0086.793] GetProcessHeap () returned 0x580000 [0086.793] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.793] GetProcessHeap () returned 0x580000 [0086.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0086.793] GetProcessHeap () returned 0x580000 [0086.794] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.794] GetProcessHeap () returned 0x580000 [0086.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1036\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0086.794] GetProcessHeap () returned 0x580000 [0086.794] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.794] GetProcessHeap () returned 0x580000 [0086.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1040\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0086.794] GetProcessHeap () returned 0x580000 [0086.794] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.794] GetProcessHeap () returned 0x580000 [0086.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1041\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0086.795] GetProcessHeap () returned 0x580000 [0086.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.795] GetProcessHeap () returned 0x580000 [0086.795] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1042\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.795] GetProcessHeap () returned 0x580000 [0086.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.795] GetProcessHeap () returned 0x580000 [0086.795] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1046\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.796] GetProcessHeap () returned 0x580000 [0086.796] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.796] GetProcessHeap () returned 0x580000 [0086.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\1049\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0086.796] GetProcessHeap () returned 0x580000 [0086.796] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.796] GetProcessHeap () returned 0x580000 [0086.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\2052\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0086.797] GetProcessHeap () returned 0x580000 [0086.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.797] GetProcessHeap () returned 0x580000 [0086.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Help\\3082\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.797] GetProcessHeap () returned 0x580000 [0086.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.797] GetProcessHeap () returned 0x580000 [0086.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.798] GetProcessHeap () returned 0x580000 [0086.798] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0086.800] GetProcessHeap () returned 0x580000 [0086.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4512fb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd4512fb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0086.800] GetProcessHeap () returned 0x580000 [0086.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.800] GetProcessHeap () returned 0x580000 [0086.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\Cultures\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc436e5a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc436e5a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc436e5a6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0086.801] GetProcessHeap () returned 0x580000 [0086.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.801] GetProcessHeap () returned 0x580000 [0086.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\OFFICE16\\en-us\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0086.801] GetProcessHeap () returned 0x580000 [0086.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.801] GetProcessHeap () returned 0x580000 [0086.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.802] GetProcessHeap () returned 0x580000 [0086.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0086.802] GetProcessHeap () returned 0x580000 [0086.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Portal\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd8e49f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0086.803] GetProcessHeap () returned 0x580000 [0086.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.803] GetProcessHeap () returned 0x580000 [0086.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.804] GetProcessHeap () returned 0x580000 [0086.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0086.805] GetProcessHeap () returned 0x580000 [0086.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA6\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0086.806] GetProcessHeap () returned 0x580000 [0086.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.806] GetProcessHeap () returned 0x580000 [0086.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0086.807] GetProcessHeap () returned 0x580000 [0086.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\VBA\\VBA7.1\\1033\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.965] GetProcessHeap () returned 0x580000 [0086.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.966] GetProcessHeap () returned 0x580000 [0086.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.966] GetProcessHeap () returned 0x580000 [0086.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.966] GetProcessHeap () returned 0x580000 [0086.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0086.967] GetProcessHeap () returned 0x580000 [0086.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0086.967] GetProcessHeap () returned 0x580000 [0086.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Web Server Extensions\\16\\BIN\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0086.968] GetProcessHeap () returned 0x580000 [0086.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.968] GetProcessHeap () returned 0x580000 [0086.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.968] GetProcessHeap () returned 0x580000 [0086.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.969] GetProcessHeap () returned 0x580000 [0086.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.969] GetProcessHeap () returned 0x580000 [0086.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0086.969] GetProcessHeap () returned 0x580000 [0086.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX86\\System\\ole db\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0086.970] GetProcessHeap () returned 0x580000 [0086.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.970] GetProcessHeap () returned 0x580000 [0086.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.970] GetProcessHeap () returned 0x580000 [0086.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0086.971] GetProcessHeap () returned 0x580000 [0086.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0086.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0086.971] GetProcessHeap () returned 0x580000 [0086.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0086.977] GetProcessHeap () returned 0x580000 [0086.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.978] GetProcessHeap () returned 0x580000 [0086.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0086.979] GetProcessHeap () returned 0x580000 [0086.979] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2a6fec90, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2aebe60a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2aebe60a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0086.981] GetProcessHeap () returned 0x580000 [0086.981] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.981] GetProcessHeap () returned 0x580000 [0086.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.981] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0086.982] GetProcessHeap () returned 0x580000 [0086.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203c0060 [0086.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x1fb9e340 | out: lpFindFileData=0x1fb9e340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0086.982] GetProcessHeap () returned 0x580000 [0086.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203c0060 | out: hHeap=0x580000) returned 1 [0086.983] GetProcessHeap () returned 0x580000 [0086.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0086.983] GetProcessHeap () returned 0x580000 [0086.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.984] GetProcessHeap () returned 0x580000 [0086.984] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.984] GetProcessHeap () returned 0x580000 [0086.984] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.984] GetProcessHeap () returned 0x580000 [0086.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft Office\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0086.985] GetProcessHeap () returned 0x580000 [0086.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.985] GetProcessHeap () returned 0x580000 [0086.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0086.986] GetProcessHeap () returned 0x580000 [0086.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0086.986] GetProcessHeap () returned 0x580000 [0086.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0086.987] GetProcessHeap () returned 0x580000 [0086.987] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.987] GetProcessHeap () returned 0x580000 [0086.987] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.988] GetProcessHeap () returned 0x580000 [0086.988] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.988] GetProcessHeap () returned 0x580000 [0086.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0086.988] GetProcessHeap () returned 0x580000 [0086.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0086.990] GetProcessHeap () returned 0x580000 [0086.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX64\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0086.991] GetProcessHeap () returned 0x580000 [0086.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0086.991] GetProcessHeap () returned 0x580000 [0086.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0086.992] GetProcessHeap () returned 0x580000 [0086.992] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0086.992] GetProcessHeap () returned 0x580000 [0086.992] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0086.992] GetProcessHeap () returned 0x580000 [0086.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0086.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0086.993] GetProcessHeap () returned 0x580000 [0086.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0086.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0086.993] GetProcessHeap () returned 0x580000 [0086.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0086.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0086.994] GetProcessHeap () returned 0x580000 [0086.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0086.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0086.995] GetProcessHeap () returned 0x580000 [0086.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0086.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Cartridges\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2afef8f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2b0ae4ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0ae4ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0087.001] GetProcessHeap () returned 0x580000 [0087.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.001] GetProcessHeap () returned 0x580000 [0087.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.005] GetProcessHeap () returned 0x580000 [0087.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203c0060 [0087.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Analysis Services\\AS OLEDB\\110\\Resources\\1033\\*", lpFindFileData=0x1fb9e340 | out: lpFindFileData=0x1fb9e340*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0087.005] GetProcessHeap () returned 0x580000 [0087.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203c0060 | out: hHeap=0x580000) returned 1 [0087.005] GetProcessHeap () returned 0x580000 [0087.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.005] GetProcessHeap () returned 0x580000 [0087.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.006] GetProcessHeap () returned 0x580000 [0087.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.006] GetProcessHeap () returned 0x580000 [0087.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.007] GetProcessHeap () returned 0x580000 [0087.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0087.007] GetProcessHeap () returned 0x580000 [0087.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.142] GetProcessHeap () returned 0x580000 [0087.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\1033\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd43957d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca99edb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e1424f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.145] GetProcessHeap () returned 0x580000 [0087.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.145] GetProcessHeap () returned 0x580000 [0087.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0087.146] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf428c77b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0087.147] GetProcessHeap () returned 0x580000 [0087.147] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\1033\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf428c77b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.147] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf428c77b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42b29f3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4848, dwReserved0=0x0, dwReserved1=0x0, cFileName="NATIVESHIM.RESOURCES.DLL", cAlternateFileName="NATIVE~1.DLL")) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf428c77b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf428c77b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42b29f3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4848, dwReserved0=0x0, dwReserved1=0x0, cFileName="NATIVESHIM.RESOURCES.DLL", cAlternateFileName="NATIVE~1.DLL")) returned 0 [0087.147] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0087.147] GetProcessHeap () returned 0x580000 [0087.147] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMessageDismissal.txt", cAlternateFileName="ACCESS~1.TXT")) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa82ce6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa82ce6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa853100, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.AuditItems.dll", cAlternateFileName="COMMON~4.DLL")) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x87b1cd2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x87b1cd2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x97efe5f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.ClientConfiguration.dll", cAlternateFileName="COCECA~1.DLL")) returned 1 [0087.147] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1814809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.DatabaseCore.dll", cAlternateFileName="COMMON~1.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1a860, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.DatabaseServices.dll", cAlternateFileName="CO3DCE~1.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5df79a9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5df79a9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5e9028c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7860, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.DBConnection.exe", cAlternateFileName="COMMON~1.EXE")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa853100, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa853100, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa89f599, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.DBConnection64.exe", cAlternateFileName="COMMON~2.EXE")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb8dd674, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb8dd674, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb9038f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x684c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.ExcelServices.dll", cAlternateFileName="CO37ED~1.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x18a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.FileUtils.dll", cAlternateFileName="COMMON~3.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf43250ed, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf43250ed, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf43e3cb7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.MsoInterop.dll", cAlternateFileName="COMMON~2.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.PasswordManager.dll", cAlternateFileName="CO07E9~1.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.ShowHelp.exe", cAlternateFileName="COMMON~3.EXE")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x305f84a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x305f84a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x36c7dee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.SqlDatabase.dll", cAlternateFileName="COF0D3~1.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cfbc75, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cfbc75, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4d48116, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2b460, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATABASECOMPARE.EXE", cAlternateFileName="DATABA~1.EXE")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e0ae4d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e0ae4d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e310c7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9060, dwReserved0=0x0, dwReserved1=0x0, cFileName="DcfMsoWrapper.dll", cAlternateFileName="DCFMSO~1.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7660, dwReserved0=0x0, dwReserved1=0x0, cFileName="DcfMsoWrapper.x86.dll", cAlternateFileName="DCFMSO~2.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6e36a06, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6e36a06, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e36a06, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x561718, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c47fe0a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c47fe0a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c47fe0a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmptyReport.rdlc", cAlternateFileName="EMPTYR~1.RDL")) returned 1 [0087.148] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0087.148] GetProcessHeap () returned 0x580000 [0087.148] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft Office\\Office16\\DCF\\en\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.150] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.151] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe3201264, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe3201264, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe330c311, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x32c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.AuditItems.Resources.dll", cAlternateFileName="COMMON~1.DLL")) returned 1 [0087.151] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.ClientConfiguration.Resources.dll", cAlternateFileName="COMMON~4.DLL")) returned 1 [0087.151] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xe8789aa5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe8789aa5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe8894afa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.ExcelServices.Resources.dll", cAlternateFileName="COMMON~2.DLL")) returned 1 [0087.151] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.FileUtils.Resources.dll", cAlternateFileName="COA5FF~1.DLL")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefdda943, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefdda943, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefdda943, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb468, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.PasswordManager.Resources.dll", cAlternateFileName="COMMON~3.DLL")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44c8b33, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2db78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DatabaseCompare.HxS", cAlternateFileName="DATABA~1.HXS")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DatabaseCompare_col.hxc", cAlternateFileName="DATABA~1.HXC")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DatabaseCompare_col.hxt", cAlternateFileName="DATABA~1.HXT")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcae6392, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcae6392, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcae6392, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="DatabaseCompare_f_col.hxk", cAlternateFileName="DATABA~1.HXK")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="DatabaseCompare_k_col.hxk", cAlternateFileName="DATABA~2.HXK")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xed5eb1ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xed5eb1ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcae6392, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36eb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetCompare.HxS", cAlternateFileName="SPREAD~1.HXS")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcae6392, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcae6392, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb0c5e7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetCompare_col.hxc", cAlternateFileName="SPREAD~1.HXC")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb0c5e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb0c5e7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetCompare_col.hxt", cAlternateFileName="SPREAD~1.HXT")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb58a9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb58a9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetCompare_f_col.hxk", cAlternateFileName="SPREAD~1.HXK")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcbcb1a5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcbcb1a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcbcb1a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetCompare_k_col.hxk", cAlternateFileName="SPREAD~2.HXK")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ab054a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5860, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetIQ.Diagram.Resources.dll", cAlternateFileName="SPREAD~3.DLL")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4b3103f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b3103f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4b3103f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe5c68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetIQ.ExcelAddin.Resources.dll", cAlternateFileName="SPREAD~2.DLL")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1814809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5270, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetIQ.ExcelServices.Resources.dll", cAlternateFileName="SPREAD~1.DLL")) returned 1 [0087.152] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1814809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5270, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetIQ.ExcelServices.Resources.dll", cAlternateFileName="SPREAD~1.DLL")) returned 0 [0087.152] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0087.153] GetProcessHeap () returned 0x580000 [0087.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.153] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1 [0087.153] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x520cca6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x520cca6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5259176, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="filecompare.exe", cAlternateFileName="FILECO~1.EXE")) returned 1 [0087.153] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b3bafd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b3bafd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b3bafd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4d050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Shared.v11.1.dll", cAlternateFileName="INC5E8~1.DLL")) returned 1 [0087.153] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c63313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4c63313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c63313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x120ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.Misc.v11.1.dll", cAlternateFileName="IN2EFE~1.DLL")) returned 1 [0087.153] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd1050, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.Misc.v8.1.dll", cAlternateFileName="INFRAG~2.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f5480d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f5480d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x218068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraChart.v11.1.Design.dll", cAlternateFileName="IN3F5C~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc5fa5d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc5fa5d2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc5fa5d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x20cac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraChart.v8.1.Design.dll", cAlternateFileName="INEBA1~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a77594, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a77594, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9a77594, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b7068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinChart.v11.1.dll", cAlternateFileName="IN23A5~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e7d566, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e7d566, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e7d566, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7c068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinEditors.v11.1.dll", cAlternateFileName="IN7A94~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b0f72e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b0f72e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinEditors.v8.1.dll", cAlternateFileName="INFRAG~4.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2fa0ca2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x232060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinGrid.v11.1.dll", cAlternateFileName="IN41D8~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5ab1579, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5ab1579, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1d5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinGrid.v8.1.dll", cAlternateFileName="IN06CE~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf158c060, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf16bd2da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x36070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinStatusBar.v11.1.dll", cAlternateFileName="INFRAG~3.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf311d3eb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf311d3eb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf311d3eb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x35068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinStatusBar.v8.1.dll", cAlternateFileName="INA095~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42070, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinTabControl.v11.1.dll", cAlternateFileName="IN1488~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinTabControl.v8.1.dll", cAlternateFileName="INFRAG~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1698075, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1698075, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1698075, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2a0ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinToolbars.v11.1.dll", cAlternateFileName="IN732F~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf53f9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf53f9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb43ee0e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x269068, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinToolbars.v8.1.dll", cAlternateFileName="IN58F0~1.DLL")) returned 1 [0087.154] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6c93006, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa0ac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinTree.v11.1.dll", cAlternateFileName="INC660~1.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f0835f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f0835f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9b060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.UltraWinTree.v8.1.dll", cAlternateFileName="IN3A49~1.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7b14e5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7b14e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7d7750, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b8048, dwReserved0=0x0, dwReserved1=0x0, cFileName="Infragistics2.Win.v11.1.dll", cAlternateFileName="IN9B72~1.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x680214, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x38c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inquire.dll", cAlternateFileName="")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x11ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Access.dao.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61d7668, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d0c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Access.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc6b9190, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc6b9190, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc6b9190, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x199a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Excel.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6297232, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6297232, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6297232, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd248, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Vbe.Interop.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xec8b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSVCR110.DLL", cAlternateFileName="")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb86af90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb86af90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8b74ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeShim.dll", cAlternateFileName="NATIVE~2.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9bf4d66, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9bf4d66, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e0ae4d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeShim.Resources.dll", cAlternateFileName="NATIVE~1.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb713a45, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb713a45, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb78613f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9aaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Northwoods.Go.dll", cAlternateFileName="NORTHW~1.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a2a905, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a2a905, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="office.dll", cAlternateFileName="")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a3ee57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a3ee57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5ad77c9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPREADSHEETCOMPARE.EXE", cAlternateFileName="SPREAD~1.EXE")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5127e7d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5127e7d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5127e7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetIQ.Diagram.dll", cAlternateFileName="SPREAD~3.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c66c57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c66c57, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1332c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetIQ.ExcelAddIn.dll", cAlternateFileName="SPREAD~1.DLL")) returned 1 [0087.155] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x40ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpreadsheetIQ.ExcelServices.dll", cAlternateFileName="SPREAD~2.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf64139b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf64139b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11058, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Compression.Base.dll", cAlternateFileName="SY9561~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Core.dll", cAlternateFileName="SYNCFU~3.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6048, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Grid.Base.dll", cAlternateFileName="SYNCFU~4.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6058, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Grid.Grouping.Base.dll", cAlternateFileName="SYC536~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf07af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf07af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf2dd35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd0060, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Grid.Grouping.Windows.dll", cAlternateFileName="SYAFCD~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e572fe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e572fe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e7d566, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x195050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Grid.Windows.dll", cAlternateFileName="SY9D98~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4cd4a32, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cd4a32, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cfac8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x88050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Grouping.Base.dll", cAlternateFileName="SYNCFU~2.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x374048, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Shared.Base.dll", cAlternateFileName="SYNCFU~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf75a8fbb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf75a8fbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf75a8fbb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Shared.Windows.dll", cAlternateFileName="SY87B2~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7b529d9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b9ee02, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6048, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Tools.Base.dll", cAlternateFileName="SY4996~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x670f8d9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x468050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.Tools.Windows.dll", cAlternateFileName="SY9B72~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x520cca6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x520cca6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x306048, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.XlsIO.Base.dll", cAlternateFileName="SY774A~1.DLL")) returned 1 [0087.156] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x520cca6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x520cca6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x306048, dwReserved0=0x0, dwReserved1=0x0, cFileName="SyncFusion.XlsIO.Base.dll", cAlternateFileName="SY774A~1.DLL")) returned 0 [0087.156] FindClose (in: hFindFile=0x2002a320 | out: hFindFile=0x2002a320) returned 1 [0087.156] GetProcessHeap () returned 0x580000 [0087.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.157] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0087.157] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1945af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1945af2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3b2a8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0087.157] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd33f011b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd33f011b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd360620a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4d690, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Interceptor.dll", cAlternateFileName="INTERC~1.DLL")) returned 1 [0087.157] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd3200239, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd3200239, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd35213f7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbb60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Interceptor.tlb", cAlternateFileName="INTERC~1.TLB")) returned 1 [0087.157] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd324c72e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x24a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="JitV.dll", cAlternateFileName="")) returned 1 [0087.157] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ab054a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ab054a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x11448, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ac3289, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d1e9216, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MINSBPROXY.DLL", cAlternateFileName="MINSBP~1.DLL")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86cced8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MINSBROAMINGPROXY.DLL", cAlternateFileName="MINSBR~1.DLL")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf016e209, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf016e209, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf016e209, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3085a99, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf475131d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22c60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSOSB.DLL", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0f23aa6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d19cde8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x6f2b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7c83c72, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7c83c72, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7c83c72, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6b538, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x519a5bb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x519a5bb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2d25b938, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xec8b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2616676, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2616676, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6bd443f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6bd443f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bd443f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4c68, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6ac83cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d25b938, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cc0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6735b3a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6735b3a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6781ff8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8cc0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="NPSPWRAP.DLL", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf134fca5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OCHelper.dll", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5df79a9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5df79a9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d1e9216, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f260, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0087.158] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa853100, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa853100, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa853100, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d4d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27878, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7a2268a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7a2268a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14888, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4abf9f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x7ec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OSFPROXY.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OSFROAMINGPROXY.DLL", cAlternateFileName="OSFROA~1.DLL")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a3ee57, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a3ee57, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e91324, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x25860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OWSCLT.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc692f34, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc692f34, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d20f472, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2658c8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OWSSUPP.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3760836, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3760836, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x236d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6c45b55, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6c45b55, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c6bda4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSCOPY.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbda21cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbda21cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSUPLD.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf428c77b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xdbcc0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb94fd84, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb94fd84, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb99c21f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x62e70, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b359a5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b359a5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x412b0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa6d5947, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa6d5947, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa82ce6a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14d50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb62ec35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb62ec35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5f1250, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VVIEWDWG.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a18be3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a18be3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2dbe50b1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa4d650, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 1 [0087.159] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a18be3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a18be3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2dbe50b1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xa4d650, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 0 [0087.160] FindClose (in: hFindFile=0x2002a0e0 | out: hFindFile=0x2002a0e0) returned 1 [0087.160] GetProcessHeap () returned 0x580000 [0087.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.160] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0 [0087.160] FindClose (in: hFindFile=0x2002a0a0 | out: hFindFile=0x2002a0a0) returned 1 [0087.160] GetProcessHeap () returned 0x580000 [0087.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.160] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0087.160] GetProcessHeap () returned 0x580000 [0087.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0087.161] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.161] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 1 [0087.161] GetProcessHeap () returned 0x580000 [0087.161] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0087.162] FindNextFileW (in: hFindFile=0x2002a1a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.162] FindNextFileW (in: hFindFile=0x2002a1a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0087.162] GetProcessHeap () returned 0x580000 [0087.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft SQL Server\\110\\Shared\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.162] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.162] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 1 [0087.163] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 0 [0087.163] FindClose (in: hFindFile=0x20029ea0 | out: hFindFile=0x20029ea0) returned 1 [0087.163] GetProcessHeap () returned 0x580000 [0087.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.163] FindNextFileW (in: hFindFile=0x2002a1a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 0 [0087.163] FindClose (in: hFindFile=0x2002a1a0 | out: hFindFile=0x2002a1a0) returned 1 [0087.163] GetProcessHeap () returned 0x580000 [0087.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.164] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0087.164] FindClose (in: hFindFile=0x20029ee0 | out: hFindFile=0x20029ee0) returned 1 [0087.164] GetProcessHeap () returned 0x580000 [0087.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.164] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0087.164] GetProcessHeap () returned 0x580000 [0087.164] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0087.164] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.164] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 1 [0087.164] GetProcessHeap () returned 0x580000 [0087.164] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.165] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.165] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 1 [0087.165] GetProcessHeap () returned 0x580000 [0087.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Microsoft.NET\\ADOMD.NET\\110\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0087.166] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.166] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e4606, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0087.166] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16e4606, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xaf898, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0087.166] FindClose (in: hFindFile=0x20029d60 | out: hFindFile=0x20029d60) returned 1 [0087.166] GetProcessHeap () returned 0x580000 [0087.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.166] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0087.166] FindClose (in: hFindFile=0x20029fe0 | out: hFindFile=0x20029fe0) returned 1 [0087.166] GetProcessHeap () returned 0x580000 [0087.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.167] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0087.167] FindClose (in: hFindFile=0x2002a360 | out: hFindFile=0x2002a360) returned 1 [0087.167] GetProcessHeap () returned 0x580000 [0087.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.167] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0087.168] GetProcessHeap () returned 0x580000 [0087.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.168] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.168] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0087.168] GetProcessHeap () returned 0x580000 [0087.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0087.169] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.169] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 1 [0087.169] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 0 [0087.169] FindClose (in: hFindFile=0x2002a0a0 | out: hFindFile=0x2002a0a0) returned 1 [0087.169] GetProcessHeap () returned 0x580000 [0087.169] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.169] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0087.169] FindClose (in: hFindFile=0x2002a420 | out: hFindFile=0x2002a420) returned 1 [0087.169] GetProcessHeap () returned 0x580000 [0087.169] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0 [0087.170] FindClose (in: hFindFile=0x20029f60 | out: hFindFile=0x20029f60) returned 1 [0087.170] GetProcessHeap () returned 0x580000 [0087.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0087.170] GetProcessHeap () returned 0x580000 [0087.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0087.170] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee7cccb2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee7cccb2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf466c4e5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27450, dwReserved0=0x0, dwReserved1=0x0, cFileName="atl100.dll", cAlternateFileName="")) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf46b8986, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d250, dwReserved0=0x0, dwReserved1=0x0, cFileName="atl110.dll", cAlternateFileName="")) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc6b9190, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f670, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d34074e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x192448, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.DLL", cAlternateFileName="")) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8268, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20ENU.DLL", cAlternateFileName="")) returned 1 [0087.170] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x55b0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140.dll", cAlternateFileName="")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0194432, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140chs.dll", cAlternateFileName="MFC140~1.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefdda943, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140cht.dll", cAlternateFileName="MFC140~2.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140deu.dll", cAlternateFileName="MFC140~3.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe460, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140enu.dll", cAlternateFileName="MFC140~4.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x100c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140esn.dll", cAlternateFileName="MF9310~1.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc5770c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x104c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140fra.dll", cAlternateFileName="MF6461~1.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140ita.dll", cAlternateFileName="MF3F49~1.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140jpn.dll", cAlternateFileName="MFC411~1.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb660, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140kor.dll", cAlternateFileName="MFBB77~1.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140rus.dll", cAlternateFileName="MF5D55~1.DLL")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x562670, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfcm140.dll", cAlternateFileName="")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfcm140u.dll", cAlternateFileName="")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x95058, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp100.dll", cAlternateFileName="")) returned 1 [0087.171] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x618c1b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp110.dll", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f458, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x99258, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8e89fe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8e89fe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcb058, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd5c75d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcdd5c75d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcdd5c75d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc8858, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr110.dll", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe9458, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib110.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc240ad7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x54cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib120.dll", cAlternateFileName="VCCORL~2.DLL")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5d660, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~3.DLL")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VEN2232.OLB", cAlternateFileName="")) returned 1 [0087.172] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VEN2232.OLB", cAlternateFileName="")) returned 0 [0087.172] FindClose (in: hFindFile=0x2002a320 | out: hFindFile=0x2002a320) returned 1 [0087.173] GetProcessHeap () returned 0x580000 [0087.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.173] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1 [0087.173] GetProcessHeap () returned 0x580000 [0087.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39870, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42acd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140.dll", cAlternateFileName="")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa68949f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa68949f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa6af6fe, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9860, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140chs.dll", cAlternateFileName="MFC140~4.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9860, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140cht.dll", cAlternateFileName="MF87C9~1.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf00af60a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10860, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140deu.dll", cAlternateFileName="MFC140~1.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x860e337, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x860e337, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdcc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140enu.dll", cAlternateFileName="MF352D~1.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22f6470, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10460, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140esn.dll", cAlternateFileName="MF9310~1.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0194432, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10860, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140fra.dll", cAlternateFileName="MFC140~2.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc6df3cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc6df3cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140ita.dll", cAlternateFileName="MF3F49~1.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb2c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140jpn.dll", cAlternateFileName="MFC140~3.DLL")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xaec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140kor.dll", cAlternateFileName="MFBB77~1.DLL")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aa3169, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aa3169, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aa3169, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf860, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140rus.dll", cAlternateFileName="MF5D55~1.DLL")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43aad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9bf4d66, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9bf4d66, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e0ae4d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15268, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfcm140.dll", cAlternateFileName="")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14cc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mfcm140u.dll", cAlternateFileName="")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b6194c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c2c3dcb, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xa1880, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscomct2.ocx", cAlternateFileName="")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x624ad43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69658, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf158c060, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1697068, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3eec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc51578a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc51578a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0087.175] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc51578a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc51578a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0087.175] FindClose (in: hFindFile=0x2002a360 | out: hFindFile=0x2002a360) returned 1 [0087.176] GetProcessHeap () returned 0x580000 [0087.176] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.176] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0087.176] GetProcessHeap () returned 0x580000 [0087.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.176] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.176] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1 [0087.176] GetProcessHeap () returned 0x580000 [0087.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0087.311] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.311] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_64", cAlternateFileName="")) returned 1 [0087.311] GetProcessHeap () returned 0x580000 [0087.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0087.312] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.312] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 1 [0087.312] GetProcessHeap () returned 0x580000 [0087.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0087.313] FindNextFileW (in: hFindFile=0x20029e20, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.313] FindNextFileW (in: hFindFile=0x20029e20, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1 [0087.313] GetProcessHeap () returned 0x580000 [0087.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.313] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0087.313] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.313] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x296f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Access.BusinessDataCatalog.DLL", cAlternateFileName="MICROS~1.DLL")) returned 1 [0087.313] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x296f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Access.BusinessDataCatalog.DLL", cAlternateFileName="MICROS~1.DLL")) returned 0 [0087.313] FindClose (in: hFindFile=0x2002a3a0 | out: hFindFile=0x2002a3a0) returned 1 [0087.314] GetProcessHeap () returned 0x580000 [0087.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.314] FindNextFileW (in: hFindFile=0x20029e20, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0087.314] FindClose (in: hFindFile=0x20029e20 | out: hFindFile=0x20029e20) returned 1 [0087.314] GetProcessHeap () returned 0x580000 [0087.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.314] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0 [0087.314] FindClose (in: hFindFile=0x20029d60 | out: hFindFile=0x20029d60) returned 1 [0087.314] GetProcessHeap () returned 0x580000 [0087.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.314] FindNextFileW (in: hFindFile=0x2002a360, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1 [0087.315] GetProcessHeap () returned 0x580000 [0087.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.317] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.317] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient", cAlternateFileName="MICROS~1.ADO")) returned 1 [0087.317] GetProcessHeap () returned 0x580000 [0087.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0087.319] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.319] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 1 [0087.319] GetProcessHeap () returned 0x580000 [0087.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0087.320] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0087.320] FindClose (in: hFindFile=0x20029da0 | out: hFindFile=0x20029da0) returned 1 [0087.320] GetProcessHeap () returned 0x580000 [0087.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.320] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0087.320] FindClose (in: hFindFile=0x2002a320 | out: hFindFile=0x2002a320) returned 1 [0087.320] GetProcessHeap () returned 0x580000 [0087.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.321] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1 [0087.321] GetProcessHeap () returned 0x580000 [0087.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0087.322] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.322] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 1 [0087.322] GetProcessHeap () returned 0x580000 [0087.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.322] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.322] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.322] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x78c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces.DLL", cAlternateFileName="MICROS~1.DLL")) returned 1 [0087.322] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x78c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces.DLL", cAlternateFileName="MICROS~1.DLL")) returned 0 [0087.323] FindClose (in: hFindFile=0x20029ea0 | out: hFindFile=0x20029ea0) returned 1 [0087.323] GetProcessHeap () returned 0x580000 [0087.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.323] FindNextFileW (in: hFindFile=0x20029d20, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0087.323] FindClose (in: hFindFile=0x20029d20 | out: hFindFile=0x20029d20) returned 1 [0087.323] GetProcessHeap () returned 0x580000 [0087.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.323] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1 [0087.323] GetProcessHeap () returned 0x580000 [0087.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.324] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.324] GetProcessHeap () returned 0x580000 [0087.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.326] GetProcessHeap () returned 0x580000 [0087.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.326] GetProcessHeap () returned 0x580000 [0087.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.327] GetProcessHeap () returned 0x580000 [0087.327] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0087.328] GetProcessHeap () returned 0x580000 [0087.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0087.328] GetProcessHeap () returned 0x580000 [0087.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.328] GetProcessHeap () returned 0x580000 [0087.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.329] GetProcessHeap () returned 0x580000 [0087.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0087.330] GetProcessHeap () returned 0x580000 [0087.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.331] GetProcessHeap () returned 0x580000 [0087.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.331] GetProcessHeap () returned 0x580000 [0087.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.331] GetProcessHeap () returned 0x580000 [0087.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.332] GetProcessHeap () returned 0x580000 [0087.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203b0058 [0087.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x1fb9e5d0 | out: lpFindFileData=0x1fb9e5d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.333] GetProcessHeap () returned 0x580000 [0087.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203b0058 | out: hHeap=0x580000) returned 1 [0087.333] GetProcessHeap () returned 0x580000 [0087.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.333] GetProcessHeap () returned 0x580000 [0087.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.334] GetProcessHeap () returned 0x580000 [0087.334] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.334] GetProcessHeap () returned 0x580000 [0087.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\INF\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.335] GetProcessHeap () returned 0x580000 [0087.335] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.335] GetProcessHeap () returned 0x580000 [0087.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.335] GetProcessHeap () returned 0x580000 [0087.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc36c3d3f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc434832e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0087.335] GetProcessHeap () returned 0x580000 [0087.335] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.335] GetProcessHeap () returned 0x580000 [0087.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0087.336] GetProcessHeap () returned 0x580000 [0087.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.336] GetProcessHeap () returned 0x580000 [0087.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-040C-1000-0000000FF1CE}\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.336] GetProcessHeap () returned 0x580000 [0087.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.336] GetProcessHeap () returned 0x580000 [0087.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-001F-0C0A-1000-0000000FF1CE}\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.338] GetProcessHeap () returned 0x580000 [0087.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.338] GetProcessHeap () returned 0x580000 [0087.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\Installer\\{90160000-006E-0409-1000-0000000FF1CE}\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.338] GetProcessHeap () returned 0x580000 [0087.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.338] GetProcessHeap () returned 0x580000 [0087.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.339] GetProcessHeap () returned 0x580000 [0087.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0087.339] GetProcessHeap () returned 0x580000 [0087.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.340] GetProcessHeap () returned 0x580000 [0087.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QHEADLES\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.341] GetProcessHeap () returned 0x580000 [0087.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.341] GetProcessHeap () returned 0x580000 [0087.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0087.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\PCHEALTH\\ERRORREP\\QSIGNOFF\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0087.341] GetProcessHeap () returned 0x580000 [0087.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0087.341] GetProcessHeap () returned 0x580000 [0087.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.342] GetProcessHeap () returned 0x580000 [0087.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.342] GetProcessHeap () returned 0x580000 [0087.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\SHELLNEW\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0087.342] GetProcessHeap () returned 0x580000 [0087.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.343] GetProcessHeap () returned 0x580000 [0087.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.343] GetProcessHeap () returned 0x580000 [0087.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0087.343] GetProcessHeap () returned 0x580000 [0087.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.344] GetProcessHeap () returned 0x580000 [0087.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0087.345] GetProcessHeap () returned 0x580000 [0087.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0087.345] GetProcessHeap () returned 0x580000 [0087.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\ClientX64\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0087.345] GetProcessHeap () returned 0x580000 [0087.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.345] GetProcessHeap () returned 0x580000 [0087.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.347] GetProcessHeap () returned 0x580000 [0087.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x21bd9dc6, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x21bd9dc6, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0087.489] GetProcessHeap () returned 0x580000 [0087.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb0da723, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xece35df2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xece35df2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.491] GetProcessHeap () returned 0x580000 [0087.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.492] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\extensions\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb40aac, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb40aac, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.492] GetProcessHeap () returned 0x580000 [0087.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.493] GetProcessHeap () returned 0x580000 [0087.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\features\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.495] GetProcessHeap () returned 0x580000 [0087.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.495] GetProcessHeap () returned 0x580000 [0087.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\browser\\VisualElements\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0087.497] GetProcessHeap () returned 0x580000 [0087.497] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.497] GetProcessHeap () returned 0x580000 [0087.497] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.497] GetProcessHeap () returned 0x580000 [0087.497] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec080216, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0087.498] GetProcessHeap () returned 0x580000 [0087.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\defaults\\pref\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.498] GetProcessHeap () returned 0x580000 [0087.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.498] GetProcessHeap () returned 0x580000 [0087.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.499] GetProcessHeap () returned 0x580000 [0087.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\dictionaries\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecc92398, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecc92398, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.500] GetProcessHeap () returned 0x580000 [0087.500] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.500] GetProcessHeap () returned 0x580000 [0087.500] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\fonts\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec0f2926, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecbad561, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecbad561, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0087.501] GetProcessHeap () returned 0x580000 [0087.501] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.501] GetProcessHeap () returned 0x580000 [0087.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecaee98b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecaee98b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.501] GetProcessHeap () returned 0x580000 [0087.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0087.502] GetProcessHeap () returned 0x580000 [0087.502] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.502] GetProcessHeap () returned 0x580000 [0087.502] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.502] GetProcessHeap () returned 0x580000 [0087.502] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Mozilla Firefox\\uninstall\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9d2ec34, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef639ad2, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef639ad2, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0087.503] GetProcessHeap () returned 0x580000 [0087.503] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.503] GetProcessHeap () returned 0x580000 [0087.503] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.503] GetProcessHeap () returned 0x580000 [0087.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0087.504] GetProcessHeap () returned 0x580000 [0087.504] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0087.504] GetProcessHeap () returned 0x580000 [0087.504] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.504] GetProcessHeap () returned 0x580000 [0087.504] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0087.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0087.507] GetProcessHeap () returned 0x580000 [0087.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0087.507] GetProcessHeap () returned 0x580000 [0087.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0087.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0087.507] GetProcessHeap () returned 0x580000 [0087.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0087.507] GetProcessHeap () returned 0x580000 [0087.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.508] GetProcessHeap () returned 0x580000 [0087.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.508] GetProcessHeap () returned 0x580000 [0087.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.508] GetProcessHeap () returned 0x580000 [0087.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.509] GetProcessHeap () returned 0x580000 [0087.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.509] GetProcessHeap () returned 0x580000 [0087.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70a5faff, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70a5faff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0087.510] GetProcessHeap () returned 0x580000 [0087.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0087.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70a3987a, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70a3987a, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0087.513] GetProcessHeap () returned 0x580000 [0087.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0087.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a3987a, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70a3987a, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70a3987a, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.514] GetProcessHeap () returned 0x580000 [0087.514] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0087.514] GetProcessHeap () returned 0x580000 [0087.514] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0087.515] GetProcessHeap () returned 0x580000 [0087.515] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0087.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0087.517] GetProcessHeap () returned 0x580000 [0087.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0087.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.518] GetProcessHeap () returned 0x580000 [0087.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0087.518] GetProcessHeap () returned 0x580000 [0087.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0087.518] GetProcessHeap () returned 0x580000 [0087.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.518] GetProcessHeap () returned 0x580000 [0087.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.519] GetProcessHeap () returned 0x580000 [0087.519] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.519] GetProcessHeap () returned 0x580000 [0087.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa73e1bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8390c831, ftLastWriteTime.dwHighDateTime=0x1d32735, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0087.521] GetProcessHeap () returned 0x580000 [0087.521] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\rempl\\Logs\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8390c831, ftCreationTime.dwHighDateTime=0x1d32735, ftLastAccessTime.dwLowDateTime=0x86e9cd10, ftLastAccessTime.dwHighDateTime=0x1d336d7, ftLastWriteTime.dwLowDateTime=0x86e9cd10, ftLastWriteTime.dwHighDateTime=0x1d336d7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0087.524] GetProcessHeap () returned 0x580000 [0087.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.524] GetProcessHeap () returned 0x580000 [0087.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.524] GetProcessHeap () returned 0x580000 [0087.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x2058f9af, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2058f9af, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0087.526] GetProcessHeap () returned 0x580000 [0087.526] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.526] GetProcessHeap () returned 0x580000 [0087.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747f43e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x749f4454, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0087.527] GetProcessHeap () returned 0x580000 [0087.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x749f4454, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa747febb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.527] GetProcessHeap () returned 0x580000 [0087.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0087.528] GetProcessHeap () returned 0x580000 [0087.528] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0087.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0087.528] GetProcessHeap () returned 0x580000 [0087.528] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0087.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76437f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0087.529] GetProcessHeap () returned 0x580000 [0087.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ar-sa\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa76f9fe7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.529] GetProcessHeap () returned 0x580000 [0087.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.529] GetProcessHeap () returned 0x580000 [0087.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\bg-BG\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0087.530] GetProcessHeap () returned 0x580000 [0087.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.530] GetProcessHeap () returned 0x580000 [0087.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.530] GetProcessHeap () returned 0x580000 [0087.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.530] GetProcessHeap () returned 0x580000 [0087.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ca-ES-valencia\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.530] GetProcessHeap () returned 0x580000 [0087.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.530] GetProcessHeap () returned 0x580000 [0087.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\cs-CZ\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\da-DK\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-AT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-CH\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.531] GetProcessHeap () returned 0x580000 [0087.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\de-DE\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0087.532] GetProcessHeap () returned 0x580000 [0087.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.532] GetProcessHeap () returned 0x580000 [0087.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\el-GR\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.532] GetProcessHeap () returned 0x580000 [0087.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.532] GetProcessHeap () returned 0x580000 [0087.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-AU\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0087.532] GetProcessHeap () returned 0x580000 [0087.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.532] GetProcessHeap () returned 0x580000 [0087.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-CA\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0087.532] GetProcessHeap () returned 0x580000 [0087.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.532] GetProcessHeap () returned 0x580000 [0087.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-GB\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.533] GetProcessHeap () returned 0x580000 [0087.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.533] GetProcessHeap () returned 0x580000 [0087.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-HK\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.533] GetProcessHeap () returned 0x580000 [0087.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.533] GetProcessHeap () returned 0x580000 [0087.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ID\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0087.533] GetProcessHeap () returned 0x580000 [0087.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.533] GetProcessHeap () returned 0x580000 [0087.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IE\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0087.533] GetProcessHeap () returned 0x580000 [0087.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.534] GetProcessHeap () returned 0x580000 [0087.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-IN\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0087.534] GetProcessHeap () returned 0x580000 [0087.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.534] GetProcessHeap () returned 0x580000 [0087.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-MY\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.534] GetProcessHeap () returned 0x580000 [0087.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.534] GetProcessHeap () returned 0x580000 [0087.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-NZ\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0087.534] GetProcessHeap () returned 0x580000 [0087.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.534] GetProcessHeap () returned 0x580000 [0087.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-PH\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-US\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\en-ZA\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-AR\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.535] GetProcessHeap () returned 0x580000 [0087.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CL\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0087.536] GetProcessHeap () returned 0x580000 [0087.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.536] GetProcessHeap () returned 0x580000 [0087.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-CO\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.643] GetProcessHeap () returned 0x580000 [0087.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.643] GetProcessHeap () returned 0x580000 [0087.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-ES\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0087.644] GetProcessHeap () returned 0x580000 [0087.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.644] GetProcessHeap () returned 0x580000 [0087.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-MX\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.644] GetProcessHeap () returned 0x580000 [0087.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.644] GetProcessHeap () returned 0x580000 [0087.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-US\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0087.644] GetProcessHeap () returned 0x580000 [0087.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.644] GetProcessHeap () returned 0x580000 [0087.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.644] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\es-XL\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.645] GetProcessHeap () returned 0x580000 [0087.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.645] GetProcessHeap () returned 0x580000 [0087.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\et-EE\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.645] GetProcessHeap () returned 0x580000 [0087.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.645] GetProcessHeap () returned 0x580000 [0087.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\eu-ES\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.646] GetProcessHeap () returned 0x580000 [0087.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.646] GetProcessHeap () returned 0x580000 [0087.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fi-FI\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.646] GetProcessHeap () returned 0x580000 [0087.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.646] GetProcessHeap () returned 0x580000 [0087.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-BE\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0087.647] GetProcessHeap () returned 0x580000 [0087.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.647] GetProcessHeap () returned 0x580000 [0087.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CA\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.647] GetProcessHeap () returned 0x580000 [0087.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.647] GetProcessHeap () returned 0x580000 [0087.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-CH\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0087.647] GetProcessHeap () returned 0x580000 [0087.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.647] GetProcessHeap () returned 0x580000 [0087.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-FR\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.647] GetProcessHeap () returned 0x580000 [0087.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.648] GetProcessHeap () returned 0x580000 [0087.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\fr-XF\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0087.648] GetProcessHeap () returned 0x580000 [0087.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.648] GetProcessHeap () returned 0x580000 [0087.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\gl-ES\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0087.648] GetProcessHeap () returned 0x580000 [0087.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.648] GetProcessHeap () returned 0x580000 [0087.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\he-IL\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0087.648] GetProcessHeap () returned 0x580000 [0087.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.648] GetProcessHeap () returned 0x580000 [0087.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hr-HR\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\hu-HU\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\is-IS\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84b3b2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\it-IT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.649] GetProcessHeap () returned 0x580000 [0087.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.649] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ja-JP\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ko-KR\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lb-LU\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85bfd1b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lt-LT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.650] GetProcessHeap () returned 0x580000 [0087.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\lv-LV\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0087.651] GetProcessHeap () returned 0x580000 [0087.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.651] GetProcessHeap () returned 0x580000 [0087.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ms-MY\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8663023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.651] GetProcessHeap () returned 0x580000 [0087.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.651] GetProcessHeap () returned 0x580000 [0087.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nb-NO\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.651] GetProcessHeap () returned 0x580000 [0087.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.651] GetProcessHeap () returned 0x580000 [0087.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-BE\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nl-NL\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\nn-NO\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pl-PL\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.652] GetProcessHeap () returned 0x580000 [0087.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-BR\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\pt-PT\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\resources\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ro-RO\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.653] GetProcessHeap () returned 0x580000 [0087.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\ru-RU\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0087.654] GetProcessHeap () returned 0x580000 [0087.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.654] GetProcessHeap () returned 0x580000 [0087.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sk-SK\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0087.654] GetProcessHeap () returned 0x580000 [0087.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.654] GetProcessHeap () returned 0x580000 [0087.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sl-SI\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0087.654] GetProcessHeap () returned 0x580000 [0087.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.654] GetProcessHeap () returned 0x580000 [0087.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sr-Latn-RS\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.654] GetProcessHeap () returned 0x580000 [0087.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.655] GetProcessHeap () returned 0x580000 [0087.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\sv-SE\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.655] GetProcessHeap () returned 0x580000 [0087.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.655] GetProcessHeap () returned 0x580000 [0087.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\th-TH\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0087.655] GetProcessHeap () returned 0x580000 [0087.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.655] GetProcessHeap () returned 0x580000 [0087.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\tr-TR\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0087.655] GetProcessHeap () returned 0x580000 [0087.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.655] GetProcessHeap () returned 0x580000 [0087.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\uk-UA\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\vi-VN\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-CN\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-HK\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.656] GetProcessHeap () returned 0x580000 [0087.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0087.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\CampaignManager\\Campaigns\\{91be532c-f9f1-406a-9858-43697c6f437a}\\Content1\\zh-TW\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.657] GetProcessHeap () returned 0x580000 [0087.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0087.657] GetProcessHeap () returned 0x580000 [0087.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0087.657] GetProcessHeap () returned 0x580000 [0087.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0087.658] GetProcessHeap () returned 0x580000 [0087.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.659] GetProcessHeap () returned 0x580000 [0087.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.659] GetProcessHeap () returned 0x580000 [0087.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\UNP\\Logs\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c52ff94, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x264bd959, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x264bd959, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0087.659] GetProcessHeap () returned 0x580000 [0087.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.659] GetProcessHeap () returned 0x580000 [0087.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.660] GetProcessHeap () returned 0x580000 [0087.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205434aa, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x205434aa, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.661] GetProcessHeap () returned 0x580000 [0087.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.661] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\en-US\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fdc6ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.663] GetProcessHeap () returned 0x580000 [0087.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.663] GetProcessHeap () returned 0x580000 [0087.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.663] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\Offline\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8fdd5e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.663] GetProcessHeap () returned 0x580000 [0087.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.663] GetProcessHeap () returned 0x580000 [0087.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.664] GetProcessHeap () returned 0x580000 [0087.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x20569715, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x20569715, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.664] GetProcessHeap () returned 0x580000 [0087.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender Advanced Threat Protection\\en-US\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa8fde773, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0087.665] GetProcessHeap () returned 0x580000 [0087.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.665] GetProcessHeap () returned 0x580000 [0087.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.665] GetProcessHeap () returned 0x580000 [0087.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0087.667] GetProcessHeap () returned 0x580000 [0087.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa90b7e0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0087.667] GetProcessHeap () returned 0x580000 [0087.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.667] GetProcessHeap () returned 0x580000 [0087.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.668] GetProcessHeap () returned 0x580000 [0087.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x2058f9af, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x2058f9af, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.669] GetProcessHeap () returned 0x580000 [0087.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\en-US\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9124bcc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.670] GetProcessHeap () returned 0x580000 [0087.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.670] GetProcessHeap () returned 0x580000 [0087.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Icons\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0087.671] GetProcessHeap () returned 0x580000 [0087.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.671] GetProcessHeap () returned 0x580000 [0087.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Media Renderer\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0087.673] GetProcessHeap () returned 0x580000 [0087.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.673] GetProcessHeap () returned 0x580000 [0087.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Network Sharing\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c5441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0087.675] GetProcessHeap () returned 0x580000 [0087.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.675] GetProcessHeap () returned 0x580000 [0087.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Skins\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c66b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0087.675] GetProcessHeap () returned 0x580000 [0087.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.675] GetProcessHeap () returned 0x580000 [0087.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\Visualizations\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0087.675] GetProcessHeap () returned 0x580000 [0087.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.675] GetProcessHeap () returned 0x580000 [0087.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.675] GetProcessHeap () returned 0x580000 [0087.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Multimedia Platform\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0087.676] GetProcessHeap () returned 0x580000 [0087.676] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.676] GetProcessHeap () returned 0x580000 [0087.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0087.676] GetProcessHeap () returned 0x580000 [0087.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c944d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7120260d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0087.676] GetProcessHeap () returned 0x580000 [0087.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\Accessories\\en-US\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c9e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.826] GetProcessHeap () returned 0x580000 [0087.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.826] GetProcessHeap () returned 0x580000 [0087.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.827] GetProcessHeap () returned 0x580000 [0087.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0087.828] GetProcessHeap () returned 0x580000 [0087.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9258521, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0087.829] GetProcessHeap () returned 0x580000 [0087.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.829] GetProcessHeap () returned 0x580000 [0087.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.830] GetProcessHeap () returned 0x580000 [0087.830] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.830] GetProcessHeap () returned 0x580000 [0087.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0087.831] GetProcessHeap () returned 0x580000 [0087.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ab93a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0087.832] GetProcessHeap () returned 0x580000 [0087.832] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.832] GetProcessHeap () returned 0x580000 [0087.832] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.832] GetProcessHeap () returned 0x580000 [0087.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x20569715, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x20569715, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0087.832] GetProcessHeap () returned 0x580000 [0087.832] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.832] GetProcessHeap () returned 0x580000 [0087.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205434aa, ftLastAccessTime.dwHighDateTime=0x1d5819a, ftLastWriteTime.dwLowDateTime=0x205434aa, ftLastWriteTime.dwHighDateTime=0x1d5819a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0087.832] GetProcessHeap () returned 0x580000 [0087.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0087.832] GetProcessHeap () returned 0x580000 [0087.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0087.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa92ae2d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0087.991] GetProcessHeap () returned 0x580000 [0087.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0087.991] GetProcessHeap () returned 0x580000 [0087.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.991] GetProcessHeap () returned 0x580000 [0087.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.991] GetProcessHeap () returned 0x580000 [0087.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0087.992] GetProcessHeap () returned 0x580000 [0087.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92af7c3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0087.992] GetProcessHeap () returned 0x580000 [0087.992] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.992] GetProcessHeap () returned 0x580000 [0087.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0087.992] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0087.992] GetProcessHeap () returned 0x580000 [0087.992] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0087.992] GetProcessHeap () returned 0x580000 [0087.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff60058 | out: hHeap=0x580000) returned 1 [0087.993] GetProcessHeap () returned 0x580000 [0087.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff60058 [0087.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\*", lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f60 [0088.002] GetProcessHeap () returned 0x580000 [0088.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x223c89ad, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93a9ec0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0088.004] GetProcessHeap () returned 0x580000 [0088.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x228b384c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa93abe68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x228b384c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0088.006] GetProcessHeap () returned 0x580000 [0088.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.006] GetProcessHeap () returned 0x580000 [0088.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa94b581e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2310be20, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0088.012] GetProcessHeap () returned 0x580000 [0088.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\App\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x229e4b3b, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95725d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a0ae1c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.015] GetProcessHeap () returned 0x580000 [0088.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.015] GetProcessHeap () returned 0x580000 [0088.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\Assets\\Periscope\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a31024, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa95a0375, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x22a572ca, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0088.018] GetProcessHeap () returned 0x580000 [0088.018] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.335] GetProcessHeap () returned 0x580000 [0088.335] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.335] GetProcessHeap () returned 0x580000 [0088.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\js\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967b88f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2313207f, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0088.337] GetProcessHeap () returned 0x580000 [0088.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.337] GetProcessHeap () returned 0x580000 [0088.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\9E2F88E3.Twitter_5.7.1.0_x86__wgeqdkkx372wm\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3002ee68, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967c915, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0088.338] GetProcessHeap () returned 0x580000 [0088.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.338] GetProcessHeap () returned 0x580000 [0088.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.339] GetProcessHeap () returned 0x580000 [0088.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Deleted\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0088.340] GetProcessHeap () returned 0x580000 [0088.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.340] GetProcessHeap () returned 0x580000 [0088.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0088.341] GetProcessHeap () returned 0x580000 [0088.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9730ad4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96c0f12e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0088.342] GetProcessHeap () returned 0x580000 [0088.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.342] GetProcessHeap () returned 0x580000 [0088.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0088.343] GetProcessHeap () returned 0x580000 [0088.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.343] GetProcessHeap () returned 0x580000 [0088.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.344] GetProcessHeap () returned 0x580000 [0088.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0088.346] GetProcessHeap () returned 0x580000 [0088.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9785683, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0088.346] GetProcessHeap () returned 0x580000 [0088.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.347] GetProcessHeap () returned 0x580000 [0088.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa97d9a35, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0088.348] GetProcessHeap () returned 0x580000 [0088.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Catalog\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e25227, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a3eee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970877d7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0088.353] GetProcessHeap () returned 0x580000 [0088.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.353] GetProcessHeap () returned 0x580000 [0088.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a4daf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0088.354] GetProcessHeap () returned 0x580000 [0088.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\Contrast-black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a634d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0088.354] GetProcessHeap () returned 0x580000 [0088.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.354] GetProcessHeap () returned 0x580000 [0088.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Contrast\\contrast-white\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a6acd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0088.355] GetProcessHeap () returned 0x580000 [0088.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.355] GetProcessHeap () returned 0x580000 [0088.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.355] GetProcessHeap () returned 0x580000 [0088.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7570, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0088.355] GetProcessHeap () returned 0x580000 [0088.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.355] GetProcessHeap () returned 0x580000 [0088.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7e68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0088.355] GetProcessHeap () returned 0x580000 [0088.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.355] GetProcessHeap () returned 0x580000 [0088.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\EmbossBitmaps\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970d3c8f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9987cd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0088.358] GetProcessHeap () returned 0x580000 [0088.359] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.359] GetProcessHeap () returned 0x580000 [0088.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\HeroHelp\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998957e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x972da738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0088.359] GetProcessHeap () returned 0x580000 [0088.359] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.359] GetProcessHeap () returned 0x580000 [0088.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa998a0eb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0088.360] GetProcessHeap () returned 0x580000 [0088.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.360] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97326c19, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a18213, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9739a738, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0088.364] GetProcessHeap () returned 0x580000 [0088.364] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.364] GetProcessHeap () returned 0x580000 [0088.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\manifestAssets\\contrast-white\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9739a738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a9f7f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974330d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.367] GetProcessHeap () returned 0x580000 [0088.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.367] GetProcessHeap () returned 0x580000 [0088.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.368] GetProcessHeap () returned 0x580000 [0088.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Office\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa16f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x975664ea, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0088.371] GetProcessHeap () returned 0x580000 [0088.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.371] GetProcessHeap () returned 0x580000 [0088.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Resources\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975664ea, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa22bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9758c747, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0088.373] GetProcessHeap () returned 0x580000 [0088.373] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.373] GetProcessHeap () returned 0x580000 [0088.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\TextureBitmaps\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b12d9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9764f8c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0088.375] GetProcessHeap () returned 0x580000 [0088.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.375] GetProcessHeap () returned 0x580000 [0088.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.375] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0088.377] GetProcessHeap () returned 0x580000 [0088.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Assets\\Workflow\\NavColumn_Black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976e822e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd111d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x977346e6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0088.379] GetProcessHeap () returned 0x580000 [0088.379] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.379] GetProcessHeap () returned 0x580000 [0088.379] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.379] GetProcessHeap () returned 0x580000 [0088.379] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.545] GetProcessHeap () returned 0x580000 [0088.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\Common\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9853e192, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd24bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0088.546] GetProcessHeap () returned 0x580000 [0088.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.546] GetProcessHeap () returned 0x580000 [0088.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3cc2682, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0088.546] GetProcessHeap () returned 0x580000 [0088.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.546] GetProcessHeap () returned 0x580000 [0088.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.547] GetProcessHeap () returned 0x580000 [0088.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.551] GetProcessHeap () returned 0x580000 [0088.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cb9e99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0088.552] GetProcessHeap () returned 0x580000 [0088.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.552] GetProcessHeap () returned 0x580000 [0088.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ccfdd0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9cba947, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33cf6025, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0088.552] GetProcessHeap () returned 0x580000 [0088.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.552] GetProcessHeap () returned 0x580000 [0088.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb4a05954, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0088.553] GetProcessHeap () returned 0x580000 [0088.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0088.555] GetProcessHeap () returned 0x580000 [0088.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.555] GetProcessHeap () returned 0x580000 [0088.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.556] GetProcessHeap () returned 0x580000 [0088.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.556] GetProcessHeap () returned 0x580000 [0088.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0088.558] GetProcessHeap () returned 0x580000 [0088.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d73fc1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e44ee0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0088.559] GetProcessHeap () returned 0x580000 [0088.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.559] GetProcessHeap () returned 0x580000 [0088.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f2112c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9e45833, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33f47386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0088.559] GetProcessHeap () returned 0x580000 [0088.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.559] GetProcessHeap () returned 0x580000 [0088.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb523798b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0088.560] GetProcessHeap () returned 0x580000 [0088.560] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0088.560] GetProcessHeap () returned 0x580000 [0088.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.561] GetProcessHeap () returned 0x580000 [0088.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.561] GetProcessHeap () returned 0x580000 [0088.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.561] GetProcessHeap () returned 0x580000 [0088.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0088.563] GetProcessHeap () returned 0x580000 [0088.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.563] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\css\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2be01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0088.564] GetProcessHeap () returned 0x580000 [0088.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.564] GetProcessHeap () returned 0x580000 [0088.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2cc20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0088.566] GetProcessHeap () returned 0x580000 [0088.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.566] GetProcessHeap () returned 0x580000 [0088.566] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\js\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0088.567] GetProcessHeap () returned 0x580000 [0088.567] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.567] GetProcessHeap () returned 0x580000 [0088.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0088.675] GetProcessHeap () returned 0x580000 [0088.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.677] GetProcessHeap () returned 0x580000 [0088.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.677] GetProcessHeap () returned 0x580000 [0088.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.678] GetProcessHeap () returned 0x580000 [0088.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.678] GetProcessHeap () returned 0x580000 [0088.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0088.682] GetProcessHeap () returned 0x580000 [0088.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa04335f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdf3689c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0088.683] GetProcessHeap () returned 0x580000 [0088.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.683] GetProcessHeap () returned 0x580000 [0088.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0088.683] GetProcessHeap () returned 0x580000 [0088.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.683] GetProcessHeap () returned 0x580000 [0088.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.683] GetProcessHeap () returned 0x580000 [0088.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0088.686] GetProcessHeap () returned 0x580000 [0088.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa096b21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.686] GetProcessHeap () returned 0x580000 [0088.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.686] GetProcessHeap () returned 0x580000 [0088.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eed6166, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa097114, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0088.687] GetProcessHeap () returned 0x580000 [0088.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.687] GetProcessHeap () returned 0x580000 [0088.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.687] GetProcessHeap () returned 0x580000 [0088.687] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0088.688] GetProcessHeap () returned 0x580000 [0088.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa098c51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0088.689] GetProcessHeap () returned 0x580000 [0088.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.689] GetProcessHeap () returned 0x580000 [0088.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0991e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0088.689] GetProcessHeap () returned 0x580000 [0088.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0088.691] GetProcessHeap () returned 0x580000 [0088.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0df02e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774b901c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.693] GetProcessHeap () returned 0x580000 [0088.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.693] GetProcessHeap () returned 0x580000 [0088.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0088.825] GetProcessHeap () returned 0x580000 [0088.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.825] GetProcessHeap () returned 0x580000 [0088.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.825] GetProcessHeap () returned 0x580000 [0088.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.826] GetProcessHeap () returned 0x580000 [0088.826] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa1412e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0088.827] GetProcessHeap () returned 0x580000 [0088.827] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.827] GetProcessHeap () returned 0x580000 [0088.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.827] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\JsonResources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0088.829] GetProcessHeap () returned 0x580000 [0088.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.829] GetProcessHeap () returned 0x580000 [0088.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776cf25e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20c37f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0088.830] GetProcessHeap () returned 0x580000 [0088.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0088.830] GetProcessHeap () returned 0x580000 [0088.831] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.831] GetProcessHeap () returned 0x580000 [0088.831] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.831] GetProcessHeap () returned 0x580000 [0088.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20dbad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0088.832] GetProcessHeap () returned 0x580000 [0088.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0088.833] GetProcessHeap () returned 0x580000 [0088.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0088.834] GetProcessHeap () returned 0x580000 [0088.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0088.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28d627, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0088.835] GetProcessHeap () returned 0x580000 [0088.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0088.835] GetProcessHeap () returned 0x580000 [0088.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0088.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28dd9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.835] GetProcessHeap () returned 0x580000 [0088.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0088.835] GetProcessHeap () returned 0x580000 [0088.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0088.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28e968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0088.835] GetProcessHeap () returned 0x580000 [0088.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0088.835] GetProcessHeap () returned 0x580000 [0088.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0088.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28f394, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0088.836] GetProcessHeap () returned 0x580000 [0088.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0088.836] GetProcessHeap () returned 0x580000 [0088.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0088.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28fe63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0088.836] GetProcessHeap () returned 0x580000 [0088.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0088.837] GetProcessHeap () returned 0x580000 [0088.837] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0088.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0088.837] GetProcessHeap () returned 0x580000 [0088.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0088.837] GetProcessHeap () returned 0x580000 [0088.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.837] GetProcessHeap () returned 0x580000 [0088.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.838] GetProcessHeap () returned 0x580000 [0088.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.839] GetProcessHeap () returned 0x580000 [0088.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0088.839] GetProcessHeap () returned 0x580000 [0088.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.840] GetProcessHeap () returned 0x580000 [0088.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0088.841] GetProcessHeap () returned 0x580000 [0088.841] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0088.841] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0088.841] GetProcessHeap () returned 0x580000 [0088.841] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0088.841] GetProcessHeap () returned 0x580000 [0088.841] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.842] GetProcessHeap () returned 0x580000 [0088.842] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.842] GetProcessHeap () returned 0x580000 [0088.842] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.843] GetProcessHeap () returned 0x580000 [0088.843] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.844] GetProcessHeap () returned 0x580000 [0088.844] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.844] GetProcessHeap () returned 0x580000 [0088.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293090, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0088.844] GetProcessHeap () returned 0x580000 [0088.844] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.845] GetProcessHeap () returned 0x580000 [0088.845] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.845] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0088.845] GetProcessHeap () returned 0x580000 [0088.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.845] GetProcessHeap () returned 0x580000 [0088.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.845] GetProcessHeap () returned 0x580000 [0088.845] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0088.847] GetProcessHeap () returned 0x580000 [0088.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293d66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70454cf5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0088.848] GetProcessHeap () returned 0x580000 [0088.848] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.848] GetProcessHeap () returned 0x580000 [0088.848] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0088.848] GetProcessHeap () returned 0x580000 [0088.848] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.848] GetProcessHeap () returned 0x580000 [0088.848] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0088.849] GetProcessHeap () returned 0x580000 [0088.849] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0088.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0088.851] GetProcessHeap () returned 0x580000 [0088.851] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.851] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d61ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0088.852] GetProcessHeap () returned 0x580000 [0088.852] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.852] GetProcessHeap () returned 0x580000 [0088.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.852] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d69dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0088.852] GetProcessHeap () returned 0x580000 [0088.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0088.854] GetProcessHeap () returned 0x580000 [0088.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.854] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa3cc321, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704c73fb, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0088.856] GetProcessHeap () returned 0x580000 [0088.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.856] GetProcessHeap () returned 0x580000 [0088.856] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0088.856] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0088.858] GetProcessHeap () returned 0x580000 [0088.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0088.858] GetProcessHeap () returned 0x580000 [0088.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.858] GetProcessHeap () returned 0x580000 [0088.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.859] GetProcessHeap () returned 0x580000 [0088.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa458f92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0088.860] GetProcessHeap () returned 0x580000 [0088.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.860] GetProcessHeap () returned 0x580000 [0088.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70585fca, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa459889, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0088.860] GetProcessHeap () returned 0x580000 [0088.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0088.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0088.861] GetProcessHeap () returned 0x580000 [0088.861] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0088.861] GetProcessHeap () returned 0x580000 [0088.861] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0088.862] GetProcessHeap () returned 0x580000 [0088.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0088.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45af55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0089.108] GetProcessHeap () returned 0x580000 [0089.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0089.109] GetProcessHeap () returned 0x580000 [0089.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0089.110] GetProcessHeap () returned 0x580000 [0089.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45dd3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0089.111] GetProcessHeap () returned 0x580000 [0089.111] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.111] GetProcessHeap () returned 0x580000 [0089.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45e65c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0089.112] GetProcessHeap () returned 0x580000 [0089.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.112] GetProcessHeap () returned 0x580000 [0089.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45f23f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0089.112] GetProcessHeap () returned 0x580000 [0089.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.112] GetProcessHeap () returned 0x580000 [0089.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45fd68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0089.112] GetProcessHeap () returned 0x580000 [0089.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.112] GetProcessHeap () returned 0x580000 [0089.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4608e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0089.113] GetProcessHeap () returned 0x580000 [0089.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.113] GetProcessHeap () returned 0x580000 [0089.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0089.113] GetProcessHeap () returned 0x580000 [0089.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.113] GetProcessHeap () returned 0x580000 [0089.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.116] GetProcessHeap () returned 0x580000 [0089.116] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.116] GetProcessHeap () returned 0x580000 [0089.116] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.117] GetProcessHeap () returned 0x580000 [0089.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0089.118] GetProcessHeap () returned 0x580000 [0089.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0089.119] GetProcessHeap () returned 0x580000 [0089.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0089.119] GetProcessHeap () returned 0x580000 [0089.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.119] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0089.120] GetProcessHeap () returned 0x580000 [0089.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.120] GetProcessHeap () returned 0x580000 [0089.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.120] GetProcessHeap () returned 0x580000 [0089.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.121] GetProcessHeap () returned 0x580000 [0089.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.122] GetProcessHeap () returned 0x580000 [0089.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0089.123] GetProcessHeap () returned 0x580000 [0089.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.123] GetProcessHeap () returned 0x580000 [0089.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa466b87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0089.123] GetProcessHeap () returned 0x580000 [0089.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.123] GetProcessHeap () returned 0x580000 [0089.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.123] GetProcessHeap () returned 0x580000 [0089.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.123] GetProcessHeap () returned 0x580000 [0089.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.124] GetProcessHeap () returned 0x580000 [0089.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0089.126] GetProcessHeap () returned 0x580000 [0089.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.126] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53e492, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c254236, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0089.127] GetProcessHeap () returned 0x580000 [0089.127] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.127] GetProcessHeap () returned 0x580000 [0089.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.127] GetProcessHeap () returned 0x580000 [0089.127] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.127] GetProcessHeap () returned 0x580000 [0089.127] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.127] GetProcessHeap () returned 0x580000 [0089.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0089.129] GetProcessHeap () returned 0x580000 [0089.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d1b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0089.130] GetProcessHeap () returned 0x580000 [0089.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.130] GetProcessHeap () returned 0x580000 [0089.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d25c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0089.130] GetProcessHeap () returned 0x580000 [0089.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d4131, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0089.133] GetProcessHeap () returned 0x580000 [0089.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa66b57d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c312cbd, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0089.135] GetProcessHeap () returned 0x580000 [0089.135] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.135] GetProcessHeap () returned 0x580000 [0089.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c2ab5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0089.137] GetProcessHeap () returned 0x580000 [0089.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.137] GetProcessHeap () returned 0x580000 [0089.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.137] GetProcessHeap () returned 0x580000 [0089.137] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.138] GetProcessHeap () returned 0x580000 [0089.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c41d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0089.138] GetProcessHeap () returned 0x580000 [0089.138] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.138] GetProcessHeap () returned 0x580000 [0089.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c48a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0089.139] GetProcessHeap () returned 0x580000 [0089.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.140] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Advertising\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0089.140] GetProcessHeap () returned 0x580000 [0089.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.140] GetProcessHeap () returned 0x580000 [0089.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.141] GetProcessHeap () returned 0x580000 [0089.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c5add, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0089.141] GetProcessHeap () returned 0x580000 [0089.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c62fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0089.142] GetProcessHeap () returned 0x580000 [0089.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.142] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73b0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.144] GetProcessHeap () returned 0x580000 [0089.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Finance\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73c941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0089.144] GetProcessHeap () returned 0x580000 [0089.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.144] GetProcessHeap () returned 0x580000 [0089.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\FoodAndDrink\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73d444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0089.145] GetProcessHeap () returned 0x580000 [0089.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.145] GetProcessHeap () returned 0x580000 [0089.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Health\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73dce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0089.145] GetProcessHeap () returned 0x580000 [0089.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.145] GetProcessHeap () returned 0x580000 [0089.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\News\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0089.298] GetProcessHeap () returned 0x580000 [0089.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.298] GetProcessHeap () returned 0x580000 [0089.298] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Sports\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73ed8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0089.298] GetProcessHeap () returned 0x580000 [0089.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.298] GetProcessHeap () returned 0x580000 [0089.298] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Services\\Personalization\\DataModels\\Weather\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73f623, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0089.299] GetProcessHeap () returned 0x580000 [0089.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.299] GetProcessHeap () returned 0x580000 [0089.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.456] GetProcessHeap () returned 0x580000 [0089.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.456] GetProcessHeap () returned 0x580000 [0089.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.457] GetProcessHeap () returned 0x580000 [0089.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0089.461] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.461] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0089.461] GetProcessHeap () returned 0x580000 [0089.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.461] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0089.462] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.462] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 1 [0089.462] GetProcessHeap () returned 0x580000 [0089.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.462] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0089.462] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.462] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0089.463] GetProcessHeap () returned 0x580000 [0089.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.463] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0089.463] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.463] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c502c94, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xcdcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNMDL2.ttf", cAlternateFileName="")) returned 1 [0089.463] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c502c94, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 1 [0089.463] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c502c94, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf530, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherColorIcons.ttf", cAlternateFileName="")) returned 0 [0089.463] FindClose (in: hFindFile=0x2002a420 | out: hFindFile=0x2002a420) returned 1 [0089.463] GetProcessHeap () returned 0x580000 [0089.463] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.463] FindNextFileW (in: hFindFile=0x2002a4e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0089.463] FindClose (in: hFindFile=0x2002a4e0 | out: hFindFile=0x2002a4e0) returned 1 [0089.463] GetProcessHeap () returned 0x580000 [0089.463] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.464] FindNextFileW (in: hFindFile=0x2002a2e0, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0089.464] FindClose (in: hFindFile=0x2002a2e0 | out: hFindFile=0x2002a2e0) returned 1 [0089.464] GetProcessHeap () returned 0x580000 [0089.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.465] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0089.465] FindClose (in: hFindFile=0x20029e60 | out: hFindFile=0x20029e60) returned 1 [0089.465] GetProcessHeap () returned 0x580000 [0089.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.465] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c502c94, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb8da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Sports.dll", cAlternateFileName="")) returned 1 [0089.466] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Msn.Sports.exe", cAlternateFileName="")) returned 1 [0089.466] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0089.466] GetProcessHeap () returned 0x580000 [0089.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0089.466] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.467] FindNextFileW (in: hFindFile=0x2002a220, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608775e5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa743364, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.467] FindClose (in: hFindFile=0x2002a220 | out: hFindFile=0x2002a220) returned 1 [0089.467] GetProcessHeap () returned 0x580000 [0089.467] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.467] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0089.467] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAdvertisingJS", cAlternateFileName="MSADVE~1")) returned 1 [0089.467] GetProcessHeap () returned 0x580000 [0089.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\MSAdvertisingJS\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0089.467] FindNextFileW (in: hFindFile=0x20029e20, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa743cf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x20029e20, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstrap.js", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x20029e20, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x20029e20, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x73d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ormma.js", cAlternateFileName="")) returned 0 [0089.468] FindClose (in: hFindFile=0x20029e20 | out: hFindFile=0x20029e20) returned 1 [0089.468] GetProcessHeap () returned 0x580000 [0089.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9edaa1, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x7f760, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9edaa1, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9edaa1, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6cad2708, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe5200, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLite3Wrapper.dll", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cad2708, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6cad2708, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6cad2708, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLiteWrapper.winmd", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0089.468] GetProcessHeap () returned 0x580000 [0089.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0089.468] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7447d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.468] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0089.468] GetProcessHeap () returned 0x580000 [0089.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Themes\\Fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0089.469] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.469] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6caf896e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x457c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DIN1451CLSHF.TTF", cAlternateFileName="")) returned 1 [0089.469] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6caf896e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x457c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DIN1451CLSHF.TTF", cAlternateFileName="")) returned 0 [0089.469] FindClose (in: hFindFile=0x20029da0 | out: hFindFile=0x20029da0) returned 1 [0089.469] GetProcessHeap () returned 0x580000 [0089.470] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.470] FindNextFileW (in: hFindFile=0x20029d60, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0089.470] FindClose (in: hFindFile=0x20029d60 | out: hFindFile=0x20029d60) returned 1 [0089.470] GetProcessHeap () returned 0x580000 [0089.470] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.470] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0089.471] GetProcessHeap () returned 0x580000 [0089.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.471] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0089.471] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.471] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2985, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.rsrc", cAlternateFileName="")) returned 1 [0089.471] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 1 [0089.471] FindNextFileW (in: hFindFile=0x2002a160, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa3, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.txt", cAlternateFileName="")) returned 0 [0089.471] FindClose (in: hFindFile=0x2002a160 | out: hFindFile=0x2002a160) returned 1 [0089.471] GetProcessHeap () returned 0x580000 [0089.471] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.471] FindNextFileW (in: hFindFile=0x2002a3e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0089.471] FindClose (in: hFindFile=0x2002a3e0 | out: hFindFile=0x2002a3e0) returned 1 [0089.471] GetProcessHeap () returned 0x580000 [0089.471] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.471] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.SCA")) returned 1 [0089.472] GetProcessHeap () returned 0x580000 [0089.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.473] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.473] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4c2aa1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e4c2aa1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e4c2aa1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xfdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0089.473] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e476601, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e476601, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0089.473] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4c2aa1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e4fcf04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0089.473] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7d9181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0089.473] GetProcessHeap () returned 0x580000 [0089.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7d9181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0089.474] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7d9181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.474] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0089.474] GetProcessHeap () returned 0x580000 [0089.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0089.476] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.476] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa84e071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0089.476] GetProcessHeap () returned 0x580000 [0089.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.476] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa84e071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0089.477] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa84e071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.477] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e4fcf04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-100.png", cAlternateFileName="")) returned 1 [0089.477] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e4fcf04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e4fcf04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0089.478] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e53dd05, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e53dd05, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0089.478] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e53dd05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e563f5f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.478] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e563f5f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e563f5f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.478] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e563f5f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e563f5f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e563f5f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.478] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e563f5f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e58a1bc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e58a1bc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0089.478] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e563f5f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e58a1bc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e58a1bc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0089.478] FindClose (in: hFindFile=0x20029e60 | out: hFindFile=0x20029e60) returned 1 [0089.479] GetProcessHeap () returned 0x580000 [0089.479] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.479] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa8cdeaf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0089.479] GetProcessHeap () returned 0x580000 [0089.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa8cdeaf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa8cdeaf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e58a1bc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e58a1bc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-100.png", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e58a1bc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e58a1bc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5b0416, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5b0416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5b0416, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5b0416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5b0416, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5b0416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5b0416, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5b0416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0089.481] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5b0416, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0089.481] FindClose (in: hFindFile=0x20029da0 | out: hFindFile=0x20029da0) returned 1 [0089.482] GetProcessHeap () returned 0x580000 [0089.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.482] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5d667d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0089.482] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5d667d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-100.png", cAlternateFileName="")) returned 1 [0089.482] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5d667d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0089.482] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5d667d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-100.png", cAlternateFileName="")) returned 1 [0089.482] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5fc917, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5fc917, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5fc917, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.482] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5fc917, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5fc917, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5fc917, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.482] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e622b9b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-100.png", cAlternateFileName="")) returned 1 [0089.483] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e622b9b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 1 [0089.483] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e622b9b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-100.png", cAlternateFileName="")) returned 0 [0089.483] FindClose (in: hFindFile=0x2002a460 | out: hFindFile=0x2002a460) returned 1 [0089.483] GetProcessHeap () returned 0x580000 [0089.483] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.483] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0089.483] FindClose (in: hFindFile=0x20029fe0 | out: hFindFile=0x20029fe0) returned 1 [0089.483] GetProcessHeap () returned 0x580000 [0089.483] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.483] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0089.484] GetProcessHeap () returned 0x580000 [0089.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0089.486] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.486] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.486] FindClose (in: hFindFile=0x20029da0 | out: hFindFile=0x20029da0) returned 1 [0089.486] GetProcessHeap () returned 0x580000 [0089.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.486] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e648df4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e648df4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0089.486] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e622b9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e648df4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e648df4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pri", cAlternateFileName="")) returned 0 [0089.486] FindClose (in: hFindFile=0x2002a0e0 | out: hFindFile=0x2002a0e0) returned 1 [0089.487] GetProcessHeap () returned 0x580000 [0089.487] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.487] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_N")) returned 1 [0089.487] GetProcessHeap () returned 0x580000 [0089.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.487] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0089.489] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.489] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce6e3c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2ce6e3c6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2ce6e3c6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0089.489] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa935760, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0089.489] GetProcessHeap () returned 0x580000 [0089.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa935760, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0089.490] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa935760, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.490] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2cdd5a7d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7511, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 1 [0089.490] FindNextFileW (in: hFindFile=0x2002a020, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cdd5a7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2cdd5a7d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2cdd5a7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x7511, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBundleManifest.xml", cAlternateFileName="")) returned 0 [0089.490] FindClose (in: hFindFile=0x2002a020 | out: hFindFile=0x2002a020) returned 1 [0089.490] GetProcessHeap () returned 0x580000 [0089.490] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.490] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ce6e3c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2ce94624, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2ce94624, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0089.490] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0089.490] GetProcessHeap () returned 0x580000 [0089.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.490] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0089.491] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.491] FindNextFileW (in: hFindFile=0x2002a3a0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0089.491] FindClose (in: hFindFile=0x2002a3a0 | out: hFindFile=0x2002a3a0) returned 1 [0089.491] GetProcessHeap () returned 0x580000 [0089.491] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.491] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0089.491] FindClose (in: hFindFile=0x20029e60 | out: hFindFile=0x20029e60) returned 1 [0089.491] GetProcessHeap () returned 0x580000 [0089.491] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.491] FindNextFileW (in: hFindFile=0x20029f60, lpFindFileData=0x1fb9f7c0 | out: lpFindFileData=0x1fb9f7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~4.0_X")) returned 1 [0089.491] GetProcessHeap () returned 0x580000 [0089.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.491] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0089.493] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2ceba882, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.493] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf531ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2cf79445, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2cf79445, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe446, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxBlockMap.xml", cAlternateFileName="")) returned 1 [0089.493] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cf2cf8e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2cf531ec, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2cf531ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x26ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxManifest.xml", cAlternateFileName="")) returned 1 [0089.493] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa936cde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxMetadata", cAlternateFileName="APPXME~1")) returned 1 [0089.493] GetProcessHeap () returned 0x580000 [0089.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.493] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa936cde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0089.493] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa936cde, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.494] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d0fdc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 1 [0089.494] FindNextFileW (in: hFindFile=0x20029ea0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d0fdc78, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d0fdc78, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeIntegrity.cat", cAlternateFileName="")) returned 0 [0089.494] FindClose (in: hFindFile=0x20029ea0 | out: hFindFile=0x20029ea0) returned 1 [0089.494] GetProcessHeap () returned 0x580000 [0089.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.494] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0844c4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d0d79eb, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d0d79eb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x29a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0089.494] FindNextFileW (in: hFindFile=0x2002a0a0, lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa937267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db7c876, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets", cAlternateFileName="")) returned 1 [0089.494] GetProcessHeap () returned 0x580000 [0089.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.494] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa937267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db7c876, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0089.494] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa937267, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db7c876, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.494] FindNextFileW (in: hFindFile=0x20029ee0, lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9d2e10, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 1 [0089.494] GetProcessHeap () returned 0x580000 [0089.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9d2e10, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0089.651] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9d2e10, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.651] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa1d3b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0089.651] GetProcessHeap () returned 0x580000 [0089.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.652] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-black\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa1d3b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0089.702] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa1d3b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1bc83f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d1bc83f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d1bc83f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-200.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1e2a9d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d1e2a9d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d1e2a9d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1be, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-200.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d1e2a9d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d1e2a9d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d1e2a9d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d208cf7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d208cf7, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d208cf7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d208cf7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d22ef50, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d22ef50, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x597, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d22ef50, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d22ef50, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d22ef50, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d22ef50, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d22ef50, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d22ef50, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2551a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2551a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2551a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xf3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-200.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2551a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2551a9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2551a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-200.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2551a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2a1660, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2a1660, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-200.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2a1660, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2a1660, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2a1660, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-200.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2c78be, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-200.png", cAlternateFileName="")) returned 1 [0089.703] FindNextFileW (in: hFindFile=0x2002a420, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2c78be, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-200.png", cAlternateFileName="")) returned 0 [0089.704] FindClose (in: hFindFile=0x2002a420 | out: hFindFile=0x2002a420) returned 1 [0089.704] GetProcessHeap () returned 0x580000 [0089.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.704] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa975ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0089.704] GetProcessHeap () returned 0x580000 [0089.704] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\contrast-white\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa975ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.706] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaa975ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.706] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2c78be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2c78be, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2c78be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_BadgeLogo.scale-200.png", cAlternateFileName="")) returned 1 [0089.706] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2f056b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2f056b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2f056b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.scale-200.png", cAlternateFileName="")) returned 1 [0089.706] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d2f056b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d2f056b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d2f056b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-16.png", cAlternateFileName="")) returned 1 [0089.706] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3167ef, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3167ef, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3167ef, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-24.png", cAlternateFileName="")) returned 1 [0089.706] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3167ef, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d33ca48, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d33ca48, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-256.png", cAlternateFileName="")) returned 1 [0089.706] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d33ca48, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d33ca48, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d33ca48, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-32.png", cAlternateFileName="")) returned 1 [0089.707] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d33ca48, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d33ca48, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d33ca48, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_LogoSmall.targetsize-48.png", cAlternateFileName="")) returned 1 [0089.707] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d33ca48, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d362ca1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d362ca1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe96, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_SplashScreen.scale-200.png", cAlternateFileName="")) returned 1 [0089.707] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d362ca1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d362ca1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d362ca1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xb32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileLargeSquare.scale-200.png", cAlternateFileName="")) returned 1 [0089.707] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d388f04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileMediumSquare.scale-200.png", cAlternateFileName="")) returned 1 [0089.707] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d388f04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileSmallSquare.scale-200.png", cAlternateFileName="")) returned 1 [0089.707] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d388f04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-200.png", cAlternateFileName="")) returned 1 [0089.707] FindNextFileW (in: hFindFile=0x2002a0e0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d388f04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather_TileWide.scale-200.png", cAlternateFileName="")) returned 0 [0089.707] FindClose (in: hFindFile=0x2002a0e0 | out: hFindFile=0x2002a0e0) returned 1 [0089.708] GetProcessHeap () returned 0x580000 [0089.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.708] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaac88c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveTile", cAlternateFileName="")) returned 1 [0089.708] GetProcessHeap () returned 0x580000 [0089.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\LiveTile\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaac88c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0089.709] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaac88c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.709] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d388f04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d388f04, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d388f04, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="10px.png", cAlternateFileName="")) returned 1 [0089.709] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3af158, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3af158, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3af158, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="1px.png", cAlternateFileName="")) returned 1 [0089.709] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3af158, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3af158, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3af158, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="2px.png", cAlternateFileName="")) returned 1 [0089.709] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3af158, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3af158, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3af158, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3px.png", cAlternateFileName="")) returned 1 [0089.709] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3d53b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3d53b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3d53b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4px.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3d53b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3d53b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3d53b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="5px.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3d53b6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3d53b6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3d53b6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6px.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3fb619, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3fb619, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3fb619, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="7px.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3fb619, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3fb619, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3fb619, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8px.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3fb619, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3fb619, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3fb619, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9px.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d3fb619, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d3fb619, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d3fb619, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons_Icon_PoP_sm.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d421872, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d421872, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d421872, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons_Icon_Wind_sm.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d421872, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d421872, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d421872, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="W0.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d421872, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d421872, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d421872, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="W1.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d421872, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d421872, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d421872, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x191, dwReserved0=0x0, dwReserved1=0x0, cFileName="W2.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d447ad0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d447ad0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d447ad0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="W3.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d447ad0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d447ad0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d447ad0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x198, dwReserved0=0x0, dwReserved1=0x0, cFileName="W4.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d447ad0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d447ad0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d447ad0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="W5.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d447ad0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d447ad0, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d447ad0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="W6.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d46dd2e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7.png", cAlternateFileName="")) returned 1 [0089.710] FindNextFileW (in: hFindFile=0x2002a320, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d46dd2e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="W7.png", cAlternateFileName="")) returned 0 [0089.711] FindClose (in: hFindFile=0x2002a320 | out: hFindFile=0x2002a320) returned 1 [0089.711] GetProcessHeap () returned 0x580000 [0089.711] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.711] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabbfeb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spacer", cAlternateFileName="")) returned 1 [0089.711] GetProcessHeap () returned 0x580000 [0089.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\Spacer\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabbfeb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabbfeb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d46dd2e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d46dd2e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d46dd2e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="10px.png", cAlternateFileName="")) returned 1 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d493f87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d493f87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d493f87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="1px.png", cAlternateFileName="")) returned 1 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d493f87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d493f87, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d493f87, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x88, dwReserved0=0x0, dwReserved1=0x0, cFileName="2px.png", cAlternateFileName="")) returned 1 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4ba1fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d4ba1fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d4ba1fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="3px.png", cAlternateFileName="")) returned 1 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4ba1fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d4ba1fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d4ba1fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4px.png", cAlternateFileName="")) returned 1 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4ba1fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d4ba1fc, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d4ba1fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="5px.png", cAlternateFileName="")) returned 1 [0089.713] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4e0430, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d4e0430, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d4e0430, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="6px.png", cAlternateFileName="")) returned 1 [0089.714] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d4e0430, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d4e0430, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d4e0430, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="7px.png", cAlternateFileName="")) returned 1 [0089.714] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d50668e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d50668e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="8px.png", cAlternateFileName="")) returned 1 [0089.714] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d50668e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d50668e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9px.png", cAlternateFileName="")) returned 1 [0089.714] FindNextFileW (in: hFindFile=0x20029da0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d50668e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d50668e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d50668e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9px.png", cAlternateFileName="")) returned 0 [0089.714] FindClose (in: hFindFile=0x20029da0 | out: hFindFile=0x20029da0) returned 1 [0089.714] GetProcessHeap () returned 0x580000 [0089.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.714] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d50668e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d52c8e8, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d52c8e8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StoreLogo.scale-200.png", cAlternateFileName="")) returned 1 [0089.715] FindNextFileW (in: hFindFile=0x2002a460, lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabc1237, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WeatherIcons", cAlternateFileName="WEATHE~1")) returned 1 [0089.715] GetProcessHeap () returned 0x580000 [0089.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabc1237, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0089.715] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaabc1237, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.715] FindNextFileW (in: hFindFile=0x20029fe0, lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac222e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="30x30", cAlternateFileName="")) returned 1 [0089.715] GetProcessHeap () returned 0x580000 [0089.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherIcons\\30x30\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac222e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0089.717] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac222e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d827806, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.717] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d59f00b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.png", cAlternateFileName="")) returned 1 [0089.717] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d59f00b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.png", cAlternateFileName="")) returned 1 [0089.717] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d59f00b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x25c, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.png", cAlternateFileName="")) returned 1 [0089.717] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d59f00b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="12.png", cAlternateFileName="")) returned 1 [0089.717] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d59f00b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="15.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d59f00b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d59f00b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d59f00b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="150.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5c5256, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d5c5256, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d5c5256, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="151.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5c5256, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d5c5256, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d5c5256, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="152.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5c5256, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d5c5256, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d5c5256, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="153.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5eb4af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d5eb4af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d5eb4af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="154.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d5eb4af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d5eb4af, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d5eb4af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="155.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d611709, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d611709, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d611709, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="156.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d611709, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d611709, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d611709, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="157.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d611709, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d611709, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d611709, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="158.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d611709, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d611709, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d611709, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="159.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d611709, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d63796b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d63796b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d63796b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d63796b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d63796b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="160.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d63796b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d63796b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d63796b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x163, dwReserved0=0x0, dwReserved1=0x0, cFileName="161.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d65dbc9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d65dbc9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d65dbc9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x0, cFileName="162.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d65dbc9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d65dbc9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d65dbc9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="163.png", cAlternateFileName="")) returned 1 [0089.718] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d65dbc9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d65dbc9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d65dbc9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x0, dwReserved1=0x0, cFileName="164.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d65dbc9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d65dbc9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d65dbc9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="165.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d65dbc9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d65dbc9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d65dbc9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="166.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d65dbc9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d65dbc9, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d65dbc9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="167.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d683e27, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d683e27, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d683e27, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x0, dwReserved1=0x0, cFileName="168.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6aa080, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6aa080, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6aa080, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="169.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6aa080, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6aa080, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6aa080, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="170.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6aa080, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6aa080, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6aa080, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="171.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6aa080, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6aa080, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6aa080, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="172.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6aa080, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6aa080, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6aa080, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x0, dwReserved1=0x0, cFileName="173.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6aa080, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6aa080, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6aa080, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x18b, dwReserved0=0x0, dwReserved1=0x0, cFileName="174.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6d02da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6d02da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6d02da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="175.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6d02da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6d02da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6d02da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x212, dwReserved0=0x0, dwReserved1=0x0, cFileName="176.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6d02da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6d02da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6d02da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20d, dwReserved0=0x0, dwReserved1=0x0, cFileName="177.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6d02da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6d02da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6d02da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="178.png", cAlternateFileName="")) returned 1 [0089.719] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6d02da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6d02da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6d02da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="179.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6d02da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6d02da, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6d02da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x169, dwReserved0=0x0, dwReserved1=0x0, cFileName="180.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6f6533, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6f6533, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6f6533, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="181.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6f6533, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6f6533, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6f6533, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x0, dwReserved1=0x0, cFileName="182.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6f6533, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6f6533, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6f6533, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="183.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6f6533, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6f6533, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6f6533, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="184.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6f6533, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d6f6533, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d6f6533, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="185.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d71c78c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d71c78c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d71c78c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="186.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d71c78c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d71c78c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d71c78c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="187.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d71c78c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d71c78c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d71c78c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x19e, dwReserved0=0x0, dwReserved1=0x0, cFileName="188.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d71c78c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d71c78c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d71c78c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="189.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d71c78c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d71c78c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d71c78c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x0, dwReserved1=0x0, cFileName="190.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d71c78c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d71c78c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d71c78c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="191.png", cAlternateFileName="")) returned 1 [0089.720] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7429e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7429e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7429e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="192.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7429e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7429e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7429e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x0, dwReserved1=0x0, cFileName="193.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7429e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7429e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7429e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="194.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7429e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7429e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7429e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="195.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7429e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7429e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7429e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="196.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d768c3f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d768c3f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d768c3f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="197.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d768c3f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d768c3f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d768c3f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="198.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d768c3f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d768c3f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d768c3f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x17e, dwReserved0=0x0, dwReserved1=0x0, cFileName="199.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d768c3f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d768c3f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d768c3f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="20.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d768c3f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d768c3f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d768c3f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="200.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d768c3f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d768c3f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d768c3f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="201.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d78ee98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d78ee98, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d78ee98, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="202.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d78ee98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d78ee98, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d78ee98, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x213, dwReserved0=0x0, dwReserved1=0x0, cFileName="203.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d78ee98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d78ee98, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d78ee98, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="204.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d78ee98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d78ee98, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d78ee98, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="23.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d78ee98, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d78ee98, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d78ee98, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="24.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7b50f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7b50f6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7b50f6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="27.png", cAlternateFileName="")) returned 1 [0089.721] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7b50f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7b50f6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7b50f6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="28.png", cAlternateFileName="")) returned 1 [0089.722] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7b50f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7b50f6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7b50f6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.png", cAlternateFileName="")) returned 1 [0089.722] FindNextFileW (in: hFindFile=0x20029e60, lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d7b50f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2d7b50f6, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2d7b50f6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="30.png", cAlternateFileName="")) returned 1 [0089.724] GetProcessHeap () returned 0x580000 [0089.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.724] GetProcessHeap () returned 0x580000 [0089.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.725] GetProcessHeap () returned 0x580000 [0089.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d827806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaac23e3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9f144d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0089.725] GetProcessHeap () returned 0x580000 [0089.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\210x173\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d827806, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaaca3951, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d9cb1f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0089.727] GetProcessHeap () returned 0x580000 [0089.727] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.727] GetProcessHeap () returned 0x580000 [0089.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\AppTiles\\WeatherImages\\423x173\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d9f144d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad0c763, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2db303c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0089.729] GetProcessHeap () returned 0x580000 [0089.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.729] GetProcessHeap () returned 0x580000 [0089.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.730] GetProcessHeap () returned 0x580000 [0089.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.730] GetProcessHeap () returned 0x580000 [0089.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Assets\\Attribution\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2db7c876, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad78aac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0089.733] GetProcessHeap () returned 0x580000 [0089.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.733] GetProcessHeap () returned 0x580000 [0089.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.734] GetProcessHeap () returned 0x580000 [0089.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad79c2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.734] GetProcessHeap () returned 0x580000 [0089.734] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.734] GetProcessHeap () returned 0x580000 [0089.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Images\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dbabacb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7a6fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dbabacb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0089.735] GetProcessHeap () returned 0x580000 [0089.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.735] GetProcessHeap () returned 0x580000 [0089.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Advertising\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd03022, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ad84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd2927f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0089.735] GetProcessHeap () returned 0x580000 [0089.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.735] GetProcessHeap () returned 0x580000 [0089.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7b5bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0089.737] GetProcessHeap () returned 0x580000 [0089.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7c2d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0089.738] GetProcessHeap () returned 0x580000 [0089.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Controls\\EndOfLife\\Assets\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7cee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.738] GetProcessHeap () returned 0x580000 [0089.738] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.738] GetProcessHeap () returned 0x580000 [0089.738] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.738] GetProcessHeap () returned 0x580000 [0089.738] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.739] GetProcessHeap () returned 0x580000 [0089.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7d91e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0089.740] GetProcessHeap () returned 0x580000 [0089.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7e777, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.872] GetProcessHeap () returned 0x580000 [0089.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0089.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7f48f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd4f4d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0089.872] GetProcessHeap () returned 0x580000 [0089.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0089.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Microsoft.Msn.Shell\\Themes\\Glyphs\\Font\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2dd4f4d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaad7ff09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2dd75732, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0089.873] GetProcessHeap () returned 0x580000 [0089.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0089.873] GetProcessHeap () returned 0x580000 [0089.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0089.876] GetProcessHeap () returned 0x580000 [0089.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.876] GetProcessHeap () returned 0x580000 [0089.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.877] GetProcessHeap () returned 0x580000 [0089.877] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x2d31f11, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x2d31f11, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0089.878] GetProcessHeap () returned 0x580000 [0089.878] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.878] GetProcessHeap () returned 0x580000 [0089.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d0fdc78, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa9368ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2d1965e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0089.878] GetProcessHeap () returned 0x580000 [0089.878] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.878] GetProcessHeap () returned 0x580000 [0089.878] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.879] GetProcessHeap () returned 0x580000 [0089.879] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f377c2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3acdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0089.880] GetProcessHeap () returned 0x580000 [0089.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68f5da18, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaae3d897, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68f83c76, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0089.883] GetProcessHeap () returned 0x580000 [0089.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.883] GetProcessHeap () returned 0x580000 [0089.883] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaae3e4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0089.883] GetProcessHeap () returned 0x580000 [0089.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.883] GetProcessHeap () returned 0x580000 [0089.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.884] GetProcessHeap () returned 0x580000 [0089.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebc8e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0089.886] GetProcessHeap () returned 0x580000 [0089.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68a98ed8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaebe349, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68a98ed8, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0089.887] GetProcessHeap () returned 0x580000 [0089.887] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.887] GetProcessHeap () returned 0x580000 [0089.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaaebeeeb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0089.888] GetProcessHeap () returned 0x580000 [0089.888] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.888] GetProcessHeap () returned 0x580000 [0089.888] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.894] GetProcessHeap () returned 0x580000 [0089.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf17e9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x61f43dfb, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0089.896] GetProcessHeap () returned 0x580000 [0089.896] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaaf18f1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68ae5394, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0089.897] GetProcessHeap () returned 0x580000 [0089.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.897] GetProcessHeap () returned 0x580000 [0089.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ae5394, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaafbd2f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x68bca1ad, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0089.900] GetProcessHeap () returned 0x580000 [0089.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.900] GetProcessHeap () returned 0x580000 [0089.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.CommsPhone_1.10.15000.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x61f43dfb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x134444f, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x134444f, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0089.902] GetProcessHeap () returned 0x580000 [0089.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.902] GetProcessHeap () returned 0x580000 [0089.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.903] GetProcessHeap () returned 0x580000 [0089.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab021835, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0089.905] GetProcessHeap () returned 0x580000 [0089.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd526822a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab022752, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd526822a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0089.905] GetProcessHeap () returned 0x580000 [0089.905] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.905] GetProcessHeap () returned 0x580000 [0089.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab022fb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0089.906] GetProcessHeap () returned 0x580000 [0089.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.906] GetProcessHeap () returned 0x580000 [0089.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0089.906] GetProcessHeap () returned 0x580000 [0089.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0089.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab088494, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0089.908] GetProcessHeap () returned 0x580000 [0089.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08a798, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0089.909] GetProcessHeap () returned 0x580000 [0089.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.909] GetProcessHeap () returned 0x580000 [0089.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.909] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd53994f2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08aff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd53994f2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0089.911] GetProcessHeap () returned 0x580000 [0089.911] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.911] GetProcessHeap () returned 0x580000 [0089.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08b876, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0089.911] GetProcessHeap () returned 0x580000 [0089.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-gb\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08c849, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0089.912] GetProcessHeap () returned 0x580000 [0089.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.912] GetProcessHeap () returned 0x580000 [0089.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0089.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\FAQ\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08d12b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0089.912] GetProcessHeap () returned 0x580000 [0089.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0089.913] GetProcessHeap () returned 0x580000 [0089.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0089.913] GetProcessHeap () returned 0x580000 [0089.913] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0089.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x628cd443, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xab08dbee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628cd443, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0090.244] GetProcessHeap () returned 0x580000 [0090.245] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.245] GetProcessHeap () returned 0x580000 [0090.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08e5b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0090.245] GetProcessHeap () returned 0x580000 [0090.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-GB\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08f2fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0090.246] GetProcessHeap () returned 0x580000 [0090.246] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.246] GetProcessHeap () returned 0x580000 [0090.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.246] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\TermsOfService\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd547e1a3, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab08fb6f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd547e1a3, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0090.247] GetProcessHeap () returned 0x580000 [0090.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.247] GetProcessHeap () returned 0x580000 [0090.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.248] GetProcessHeap () returned 0x580000 [0090.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.ConnectivityStore_1.1509.1.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5373138, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xab089e41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd5373138, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0090.248] GetProcessHeap () returned 0x580000 [0090.248] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.248] GetProcessHeap () returned 0x580000 [0090.248] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.248] GetProcessHeap () returned 0x580000 [0090.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.248] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d296410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.250] GetProcessHeap () returned 0x580000 [0090.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.250] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d2bc66a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab13f343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0090.251] GetProcessHeap () returned 0x580000 [0090.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d308b21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1ce307, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d32ed7f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0090.254] GetProcessHeap () returned 0x580000 [0090.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.254] GetProcessHeap () returned 0x580000 [0090.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d32ed7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab1d0bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d37b231, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0090.256] GetProcessHeap () returned 0x580000 [0090.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.256] GetProcessHeap () returned 0x580000 [0090.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.257] GetProcessHeap () returned 0x580000 [0090.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb9355ef2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb9355ef2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb9355ef2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.258] GetProcessHeap () returned 0x580000 [0090.258] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.259] GetProcessHeap () returned 0x580000 [0090.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.260] GetProcessHeap () returned 0x580000 [0090.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c531351, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0090.274] GetProcessHeap () returned 0x580000 [0090.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c5575af, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab228e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c5575af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0090.275] GetProcessHeap () returned 0x580000 [0090.275] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.275] GetProcessHeap () returned 0x580000 [0090.275] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cdf7b05, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab2732ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1b15f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0090.277] GetProcessHeap () returned 0x580000 [0090.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9cf75299, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab3100a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d080313, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0090.281] GetProcessHeap () returned 0x580000 [0090.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.281] GetProcessHeap () returned 0x580000 [0090.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d080313, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab39d704, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d18b39b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.284] GetProcessHeap () returned 0x580000 [0090.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.284] GetProcessHeap () returned 0x580000 [0090.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\Assets\\FileIcons\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d18b39b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab446b84, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9d1d7849, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0090.286] GetProcessHeap () returned 0x580000 [0090.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.286] GetProcessHeap () returned 0x580000 [0090.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.287] GetProcessHeap () returned 0x580000 [0090.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfe80d855, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe80d855, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.288] GetProcessHeap () returned 0x580000 [0090.288] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.288] GetProcessHeap () returned 0x580000 [0090.288] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.289] GetProcessHeap () returned 0x580000 [0090.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.290] GetProcessHeap () returned 0x580000 [0090.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c3b24a6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab4afc0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9c3b24a6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.291] GetProcessHeap () returned 0x580000 [0090.291] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.291] GetProcessHeap () returned 0x580000 [0090.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_1.1.25002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb932fcac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb932fcac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb932fcac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0090.292] GetProcessHeap () returned 0x580000 [0090.292] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.292] GetProcessHeap () returned 0x580000 [0090.292] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.292] GetProcessHeap () returned 0x580000 [0090.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0090.294] GetProcessHeap () returned 0x580000 [0090.294] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fe54df6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab549f27, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fed1b77, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0090.431] GetProcessHeap () returned 0x580000 [0090.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.431] GetProcessHeap () returned 0x580000 [0090.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad8fd68, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad8fd68, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad8fd68, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0090.432] GetProcessHeap () returned 0x580000 [0090.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.433] GetProcessHeap () returned 0x580000 [0090.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.433] GetProcessHeap () returned 0x580000 [0090.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.434] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0090.435] GetProcessHeap () returned 0x580000 [0090.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.435] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ed19195, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5eb5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ed19195, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0090.436] GetProcessHeap () returned 0x580000 [0090.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.436] GetProcessHeap () returned 0x580000 [0090.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad4389d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad4389d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad4389d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0090.436] GetProcessHeap () returned 0x580000 [0090.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.437] GetProcessHeap () returned 0x580000 [0090.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.437] GetProcessHeap () returned 0x580000 [0090.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.437] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7eee2de1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0090.439] GetProcessHeap () returned 0x580000 [0090.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ef09035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5edb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7ef09035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0090.439] GetProcessHeap () returned 0x580000 [0090.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.439] GetProcessHeap () returned 0x580000 [0090.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f2d055d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6bff9c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f8f31a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0090.457] GetProcessHeap () returned 0x580000 [0090.457] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.457] GetProcessHeap () returned 0x580000 [0090.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.457] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c0da4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0090.457] GetProcessHeap () returned 0x580000 [0090.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.458] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c1a05, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0090.494] GetProcessHeap () returned 0x580000 [0090.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-GB\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f8f31a9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c20a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f919407, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0090.495] GetProcessHeap () returned 0x580000 [0090.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.495] GetProcessHeap () returned 0x580000 [0090.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\desktop\\en-US\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f919407, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c24fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f93f661, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0090.495] GetProcessHeap () returned 0x580000 [0090.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.495] GetProcessHeap () returned 0x580000 [0090.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.496] GetProcessHeap () returned 0x580000 [0090.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.496] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2a52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0090.497] GetProcessHeap () returned 0x580000 [0090.497] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\holoLens\\en-US\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c2f47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.498] GetProcessHeap () returned 0x580000 [0090.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.498] GetProcessHeap () returned 0x580000 [0090.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.498] GetProcessHeap () returned 0x580000 [0090.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c3363, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0090.499] GetProcessHeap () returned 0x580000 [0090.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.499] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\images\\en-US\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9658ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c39d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9658ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0090.499] GetProcessHeap () returned 0x580000 [0090.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.499] GetProcessHeap () returned 0x580000 [0090.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.500] GetProcessHeap () returned 0x580000 [0090.500] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4278, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0090.500] GetProcessHeap () returned 0x580000 [0090.500] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-GB\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c4ac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0090.501] GetProcessHeap () returned 0x580000 [0090.501] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.501] GetProcessHeap () returned 0x580000 [0090.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\mobile\\en-US\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c5109, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f98bb1c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0090.501] GetProcessHeap () returned 0x580000 [0090.501] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.501] GetProcessHeap () returned 0x580000 [0090.501] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.501] GetProcessHeap () returned 0x580000 [0090.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c57e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.501] GetProcessHeap () returned 0x580000 [0090.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.501] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-GB\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f98bb1c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c60ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f9fe269, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0090.502] GetProcessHeap () returned 0x580000 [0090.502] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.502] GetProcessHeap () returned 0x580000 [0090.502] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Content\\surfaceHub\\en-US\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9fe269, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c6700, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa28bd5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0090.502] GetProcessHeap () returned 0x580000 [0090.502] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.502] GetProcessHeap () returned 0x580000 [0090.502] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.503] GetProcessHeap () returned 0x580000 [0090.503] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.503] GetProcessHeap () returned 0x580000 [0090.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbad69af3, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbad69af3, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbad69af3, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.503] GetProcessHeap () returned 0x580000 [0090.503] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.503] GetProcessHeap () returned 0x580000 [0090.504] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa4ee54, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab6c7513, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fa750b2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0090.504] GetProcessHeap () returned 0x580000 [0090.504] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.504] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa750b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78e843, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0090.506] GetProcessHeap () returned 0x580000 [0090.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\Images\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fa9b30b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78f63a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0090.506] GetProcessHeap () returned 0x580000 [0090.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.506] GetProcessHeap () returned 0x580000 [0090.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\Resources\\TopicPage\\PartnerJS\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fac1569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab78fdf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7fac1569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0090.506] GetProcessHeap () returned 0x580000 [0090.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.506] GetProcessHeap () returned 0x580000 [0090.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.507] GetProcessHeap () returned 0x580000 [0090.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.507] GetProcessHeap () returned 0x580000 [0090.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.507] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f0140b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab5ed36f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7f2aa2da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0090.507] GetProcessHeap () returned 0x580000 [0090.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.508] GetProcessHeap () returned 0x580000 [0090.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.508] GetProcessHeap () returned 0x580000 [0090.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.509] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0090.510] GetProcessHeap () returned 0x580000 [0090.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.510] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x287b925a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab841b4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x287b925a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.511] GetProcessHeap () returned 0x580000 [0090.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.511] GetProcessHeap () returned 0x580000 [0090.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.511] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.2.24002.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0090.512] GetProcessHeap () returned 0x580000 [0090.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.512] GetProcessHeap () returned 0x580000 [0090.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.512] GetProcessHeap () returned 0x580000 [0090.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.512] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a48b6f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0090.513] GetProcessHeap () returned 0x580000 [0090.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29a95021, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9559ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x29c3c6c4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0090.516] GetProcessHeap () returned 0x580000 [0090.516] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.516] GetProcessHeap () returned 0x580000 [0090.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_neutral_split.scale-150_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8c685e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbd8c685e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8c685e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0090.642] GetProcessHeap () returned 0x580000 [0090.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.642] GetProcessHeap () returned 0x580000 [0090.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.642] GetProcessHeap () returned 0x580000 [0090.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.643] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2889e07b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbd8a0611, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbd8a0611, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.644] GetProcessHeap () returned 0x580000 [0090.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2891078c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9bb295, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2891078c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0090.645] GetProcessHeap () returned 0x580000 [0090.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.645] GetProcessHeap () returned 0x580000 [0090.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.645] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2895cc43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb21004, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28bc9f4c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0090.647] GetProcessHeap () returned 0x580000 [0090.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x289a90fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb2233c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x289a90fa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0090.648] GetProcessHeap () returned 0x580000 [0090.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.648] GetProcessHeap () returned 0x580000 [0090.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.648] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\Assets\\Sounds\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28a67cbd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb22dfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x28a67cbd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0090.648] GetProcessHeap () returned 0x580000 [0090.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.649] GetProcessHeap () returned 0x580000 [0090.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.650] GetProcessHeap () returned 0x580000 [0090.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbd8a0611, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xfbac0b62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfbac0b62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.651] GetProcessHeap () returned 0x580000 [0090.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.651] GetProcessHeap () returned 0x580000 [0090.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.651] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\TEE\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957986f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb25901, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2993daf0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0090.653] GetProcessHeap () returned 0x580000 [0090.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.653] GetProcessHeap () returned 0x580000 [0090.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.653] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x289369e5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xab9baa69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x289369e5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.653] GetProcessHeap () returned 0x580000 [0090.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.653] GetProcessHeap () returned 0x580000 [0090.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.654] GetProcessHeap () returned 0x580000 [0090.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.654] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac06201d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0090.655] GetProcessHeap () returned 0x580000 [0090.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac08827b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabb9e6bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac08827b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.656] GetProcessHeap () returned 0x580000 [0090.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.656] GetProcessHeap () returned 0x580000 [0090.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.656] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0090.657] GetProcessHeap () returned 0x580000 [0090.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.657] GetProcessHeap () returned 0x580000 [0090.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.657] GetProcessHeap () returned 0x580000 [0090.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac29e374, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xbed30aaa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0090.658] GetProcessHeap () returned 0x580000 [0090.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.658] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac2ea82c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba0d3c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac2ea82c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0090.659] GetProcessHeap () returned 0x580000 [0090.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.659] GetProcessHeap () returned 0x580000 [0090.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.659] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba158a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0090.659] GetProcessHeap () returned 0x580000 [0090.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac526b7e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba219f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac526b7e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.660] GetProcessHeap () returned 0x580000 [0090.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.660] GetProcessHeap () returned 0x580000 [0090.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba2cef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac54cddc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0090.660] GetProcessHeap () returned 0x580000 [0090.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.660] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Tiles\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac54cddc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf3417, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac59928e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0090.662] GetProcessHeap () returned 0x580000 [0090.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.662] GetProcessHeap () returned 0x580000 [0090.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.662] GetProcessHeap () returned 0x580000 [0090.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.662] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\Assets\\Viewer\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac59928e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabbf429c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac657e5b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0090.663] GetProcessHeap () returned 0x580000 [0090.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.663] GetProcessHeap () returned 0x580000 [0090.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.664] GetProcessHeap () returned 0x580000 [0090.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbed30aaa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xabbf4c99, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbed30aaa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0090.664] GetProcessHeap () returned 0x580000 [0090.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.664] GetProcessHeap () returned 0x580000 [0090.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac310a85, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabba02f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xac310a85, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0090.664] GetProcessHeap () returned 0x580000 [0090.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.664] GetProcessHeap () returned 0x580000 [0090.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.665] GetProcessHeap () returned 0x580000 [0090.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62a7e361, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0090.667] GetProcessHeap () returned 0x580000 [0090.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62aca818, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4070c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62aca818, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0090.668] GetProcessHeap () returned 0x580000 [0090.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.668] GetProcessHeap () returned 0x580000 [0090.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62baf63d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc41746, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.670] GetProcessHeap () returned 0x580000 [0090.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.670] GetProcessHeap () returned 0x580000 [0090.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\loc\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62c6e205, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc423fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x62c6e205, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0090.670] GetProcessHeap () returned 0x580000 [0090.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.670] GetProcessHeap () returned 0x580000 [0090.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0090.671] GetProcessHeap () returned 0x580000 [0090.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.671] GetProcessHeap () returned 0x580000 [0090.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4357d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x63720995, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0090.672] GetProcessHeap () returned 0x580000 [0090.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\Office16\\1033\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x636ae280, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc4416c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x636ae280, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0090.673] GetProcessHeap () returned 0x580000 [0090.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.673] GetProcessHeap () returned 0x580000 [0090.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.674] GetProcessHeap () returned 0x580000 [0090.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\strings\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc44b63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6395ccec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0090.674] GetProcessHeap () returned 0x580000 [0090.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.675] GetProcessHeap () returned 0x580000 [0090.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\VFS\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6395ccec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabc45469, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x662a39a5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0090.675] GetProcessHeap () returned 0x580000 [0090.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.675] GetProcessHeap () returned 0x580000 [0090.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\\XMLOffKeys\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x663d4c5d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabd372f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6644736d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80000018, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.677] GetProcessHeap () returned 0x580000 [0090.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.677] GetProcessHeap () returned 0x580000 [0090.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.678] GetProcessHeap () returned 0x580000 [0090.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.876] GetProcessHeap () returned 0x580000 [0090.876] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x628da999, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabdaf1a7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x628da999, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0090.877] GetProcessHeap () returned 0x580000 [0090.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.877] GetProcessHeap () returned 0x580000 [0090.877] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftOfficeHub_2017.311.255.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc3123ced, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc3123ced, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc3123ced, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.877] GetProcessHeap () returned 0x580000 [0090.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.877] GetProcessHeap () returned 0x580000 [0090.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.878] GetProcessHeap () returned 0x580000 [0090.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.878] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x390dfd83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0090.880] GetProcessHeap () returned 0x580000 [0090.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x391eadfd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe0794e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3925d50d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0090.880] GetProcessHeap () returned 0x580000 [0090.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\Livetiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39211056, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabe5a941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x392372b0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0090.883] GetProcessHeap () returned 0x580000 [0090.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.883] GetProcessHeap () returned 0x580000 [0090.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.884] GetProcessHeap () returned 0x580000 [0090.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0090.885] GetProcessHeap () returned 0x580000 [0090.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.885] GetProcessHeap () returned 0x580000 [0090.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.886] GetProcessHeap () returned 0x580000 [0090.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0090.888] GetProcessHeap () returned 0x580000 [0090.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33798b5a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabec308c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33798b5a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0090.888] GetProcessHeap () returned 0x580000 [0090.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.889] GetProcessHeap () returned 0x580000 [0090.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96c435e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc96c435e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96c435e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0090.889] GetProcessHeap () returned 0x580000 [0090.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.889] GetProcessHeap () returned 0x580000 [0090.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0090.897] GetProcessHeap () returned 0x580000 [0090.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0090.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34052404, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xc96ea5b4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xc96ea5b4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0090.899] GetProcessHeap () returned 0x580000 [0090.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340ead73, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf3049c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x340ead73, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.899] GetProcessHeap () returned 0x580000 [0090.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.899] GetProcessHeap () returned 0x580000 [0090.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf30abf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342422a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0090.899] GetProcessHeap () returned 0x580000 [0090.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Awards\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342422a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf96d1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342b49b5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0090.902] GetProcessHeap () returned 0x580000 [0090.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0090.902] GetProcessHeap () returned 0x580000 [0090.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0090.903] GetProcessHeap () returned 0x580000 [0090.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0090.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf9793f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x342dac13, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0090.905] GetProcessHeap () returned 0x580000 [0090.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0090.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabffc808, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0090.907] GetProcessHeap () returned 0x580000 [0090.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Animation\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342dac13, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac04346d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x344583a2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0090.910] GetProcessHeap () returned 0x580000 [0090.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.910] GetProcessHeap () returned 0x580000 [0090.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Audio\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3447e5fb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac043e7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3447e5fb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0090.910] GetProcessHeap () returned 0x580000 [0090.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.911] GetProcessHeap () returned 0x580000 [0090.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.911] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Calendar\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x344f0d0c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac044536, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x344f0d0c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0090.912] GetProcessHeap () returned 0x580000 [0090.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.912] GetProcessHeap () returned 0x580000 [0090.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Perfect\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3453d1c3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac044a68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x345651d2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0090.912] GetProcessHeap () returned 0x580000 [0090.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.912] GetProcessHeap () returned 0x580000 [0090.913] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Popups\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3458b455, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac0bb1e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3464a018, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0090.914] GetProcessHeap () returned 0x580000 [0090.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0090.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Popups\\Upsell\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3464a018, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac12f3ab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34670276, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0090.917] GetProcessHeap () returned 0x580000 [0090.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0090.917] GetProcessHeap () returned 0x580000 [0090.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0090.917] GetProcessHeap () returned 0x580000 [0090.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0090.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\PrizeHistory\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34670276, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18e78c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34708be4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0091.103] GetProcessHeap () returned 0x580000 [0091.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.103] GetProcessHeap () returned 0x580000 [0091.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\ProgressBar\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34708be4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18f047, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34708be4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0091.103] GetProcessHeap () returned 0x580000 [0091.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.103] GetProcessHeap () returned 0x580000 [0091.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.DailyChallenges\\Assets\\Tab\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3472fed7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac18f99f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3472fed7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.104] GetProcessHeap () returned 0x580000 [0091.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.104] GetProcessHeap () returned 0x580000 [0091.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.105] GetProcessHeap () returned 0x580000 [0091.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.105] GetProcessHeap () returned 0x580000 [0091.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac190436, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3477c3bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.106] GetProcessHeap () returned 0x580000 [0091.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.News\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3477c3bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fc576, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.109] GetProcessHeap () returned 0x580000 [0091.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.109] GetProcessHeap () returned 0x580000 [0091.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.110] GetProcessHeap () returned 0x580000 [0091.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac1fd71d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347a261b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0091.110] GetProcessHeap () returned 0x580000 [0091.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.111] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac275cac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0091.112] GetProcessHeap () returned 0x580000 [0091.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Animation\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x347a261b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac318bc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x347eead2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.114] GetProcessHeap () returned 0x580000 [0091.114] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.114] GetProcessHeap () returned 0x580000 [0091.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Badges\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34814d2b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3196ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34814d2b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0091.115] GetProcessHeap () returned 0x580000 [0091.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.115] GetProcessHeap () returned 0x580000 [0091.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Pin\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x348db826, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac319e44, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x348db826, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0091.115] GetProcessHeap () returned 0x580000 [0091.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.115] GetProcessHeap () returned 0x580000 [0091.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Sounds\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x348db826, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac36e3cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34927cf5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.117] GetProcessHeap () returned 0x580000 [0091.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.117] GetProcessHeap () returned 0x580000 [0091.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.117] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.StarClub\\Assets\\Stripes\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac36f571, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.118] GetProcessHeap () returned 0x580000 [0091.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.118] GetProcessHeap () returned 0x580000 [0091.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.118] GetProcessHeap () returned 0x580000 [0091.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.118] GetProcessHeap () returned 0x580000 [0091.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.118] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac3703f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.119] GetProcessHeap () returned 0x580000 [0091.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.120] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Upsell\\Default\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3499a434, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371336, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3499a434, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0091.120] GetProcessHeap () returned 0x580000 [0091.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.120] GetProcessHeap () returned 0x580000 [0091.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.121] GetProcessHeap () returned 0x580000 [0091.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac371ee7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0091.122] GetProcessHeap () returned 0x580000 [0091.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac487abd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0091.124] GetProcessHeap () returned 0x580000 [0091.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Buttons\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac488be1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a0cb16, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.124] GetProcessHeap () returned 0x580000 [0091.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Buttons\\Back\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x349e68bd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac489905, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x349e68bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0091.125] GetProcessHeap () returned 0x580000 [0091.125] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.125] GetProcessHeap () returned 0x580000 [0091.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Buttons\\Menu\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34a0cb16, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac52ad21, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a32d6a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0091.198] GetProcessHeap () returned 0x580000 [0091.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.198] GetProcessHeap () returned 0x580000 [0091.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.199] GetProcessHeap () returned 0x580000 [0091.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\Hud\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34acb6c6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac52b9f7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34af1924, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.199] GetProcessHeap () returned 0x580000 [0091.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.199] GetProcessHeap () returned 0x580000 [0091.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Arkadium.Win10.Xaml.Toolkit\\Assets\\XboxControl\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34af1924, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac5cdd03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34b17b7d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0091.202] GetProcessHeap () returned 0x580000 [0091.202] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.202] GetProcessHeap () returned 0x580000 [0091.202] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.203] GetProcessHeap () returned 0x580000 [0091.203] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.203] GetProcessHeap () returned 0x580000 [0091.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b17b7d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac644067, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0091.205] GetProcessHeap () returned 0x580000 [0091.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Advertisement\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac645b09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34b64035, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.206] GetProcessHeap () returned 0x580000 [0091.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.206] GetProcessHeap () returned 0x580000 [0091.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Audio\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34b64035, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6cbcfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34c48e56, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0091.207] GetProcessHeap () returned 0x580000 [0091.208] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.208] GetProcessHeap () returned 0x580000 [0091.208] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.208] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c48e56, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac6cce12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x350306db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0091.252] GetProcessHeap () returned 0x580000 [0091.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\challenge\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34c48e56, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac779db7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34d56040, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0091.254] GetProcessHeap () returned 0x580000 [0091.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.254] GetProcessHeap () returned 0x580000 [0091.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\common\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34d56040, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac7e1fd7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34e610ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0091.256] GetProcessHeap () returned 0x580000 [0091.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.256] GetProcessHeap () returned 0x580000 [0091.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\freecell\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34e610ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac845f95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34e87318, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0091.258] GetProcessHeap () returned 0x580000 [0091.258] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.258] GetProcessHeap () returned 0x580000 [0091.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.258] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\klondike\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34ead571, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8488db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34ef9a28, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0091.260] GetProcessHeap () returned 0x580000 [0091.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.261] GetProcessHeap () returned 0x580000 [0091.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\pyramid\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34f1fc81, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8a1411, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f97d43, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0091.263] GetProcessHeap () returned 0x580000 [0091.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.263] GetProcessHeap () returned 0x580000 [0091.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\spider\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34f97d43, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac8e55e7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3500a487, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.264] GetProcessHeap () returned 0x580000 [0091.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.264] GetProcessHeap () returned 0x580000 [0091.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Awards\\tripeaks\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x350306db, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac95908b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x350c904a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0091.267] GetProcessHeap () returned 0x580000 [0091.267] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.267] GetProcessHeap () returned 0x580000 [0091.267] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.267] GetProcessHeap () returned 0x580000 [0091.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x350f002f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac95a2c9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352c9059, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0091.270] GetProcessHeap () returned 0x580000 [0091.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.270] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons\\Deal\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x350f002f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xac9df1ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3513c50b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0091.272] GetProcessHeap () returned 0x580000 [0091.272] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.272] GetProcessHeap () returned 0x580000 [0091.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons\\FullScreen\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3513c50b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca3dcfb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35197d53, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.274] GetProcessHeap () returned 0x580000 [0091.274] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.274] GetProcessHeap () returned 0x580000 [0091.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons\\GiveUp\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35197d53, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca840b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x351bdfd6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.276] GetProcessHeap () returned 0x580000 [0091.276] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.276] GetProcessHeap () returned 0x580000 [0091.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons\\Solve\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x351bdfd6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacad2aaa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35256944, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.278] GetProcessHeap () returned 0x580000 [0091.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.278] GetProcessHeap () returned 0x580000 [0091.278] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons\\TryAgain\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3527cb9e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacc01122, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352c9059, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0091.280] GetProcessHeap () returned 0x580000 [0091.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.280] GetProcessHeap () returned 0x580000 [0091.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Buttons\\Undo\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x352c9059, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacc863de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x352f22cf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0091.282] GetProcessHeap () returned 0x580000 [0091.282] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.282] GetProcessHeap () returned 0x580000 [0091.282] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.283] GetProcessHeap () returned 0x580000 [0091.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\DailyChallenges\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3533dfe8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaccce3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x355540e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0091.285] GetProcessHeap () returned 0x580000 [0091.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\DailyChallenges\\Icons\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35364241, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacccf58b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35364241, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.286] GetProcessHeap () returned 0x580000 [0091.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.286] GetProcessHeap () returned 0x580000 [0091.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\DailyChallenges\\LobbyTiles\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x353b06f8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacd36e5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x353d6951, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.299] GetProcessHeap () returned 0x580000 [0091.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.299] GetProcessHeap () returned 0x580000 [0091.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\DailyChallenges\\Popup\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x353fcbab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacd9987b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35495519, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.301] GetProcessHeap () returned 0x580000 [0091.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.301] GetProcessHeap () returned 0x580000 [0091.301] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\DailyChallenges\\Tile\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x355540e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacd9a8ce, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x355540e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.302] GetProcessHeap () returned 0x580000 [0091.302] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.302] GetProcessHeap () returned 0x580000 [0091.302] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.302] GetProcessHeap () returned 0x580000 [0091.302] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Fireworks\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3557a33f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacd9b495, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x355a0598, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0091.304] GetProcessHeap () returned 0x580000 [0091.304] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.304] GetProcessHeap () returned 0x580000 [0091.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.304] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Fues\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x355c67f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace02661, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3576d4df, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.307] GetProcessHeap () returned 0x580000 [0091.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.307] GetProcessHeap () returned 0x580000 [0091.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GameEnd\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35793738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace05649, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3582c0a2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0091.310] GetProcessHeap () returned 0x580000 [0091.310] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.310] GetProcessHeap () returned 0x580000 [0091.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.310] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35852300, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace066b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35f531bc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0091.311] GetProcessHeap () returned 0x580000 [0091.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\FreeCell\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35878559, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace07319, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35878559, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.318] GetProcessHeap () returned 0x580000 [0091.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\FreeCell\\ResPacks\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35878559, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace07e04, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35878559, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0091.318] GetProcessHeap () returned 0x580000 [0091.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.318] GetProcessHeap () returned 0x580000 [0091.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.319] GetProcessHeap () returned 0x580000 [0091.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Klondike\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3589e7b7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace08745, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3589e7b7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0091.319] GetProcessHeap () returned 0x580000 [0091.320] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Klondike\\ResPacks\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3589e7b7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xace091ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3589e7b7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.320] GetProcessHeap () returned 0x580000 [0091.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.320] GetProcessHeap () returned 0x580000 [0091.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.320] GetProcessHeap () returned 0x580000 [0091.320] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Localization\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x358c4a10, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1abf4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35d3d0be, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0091.328] GetProcessHeap () returned 0x580000 [0091.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.328] GetProcessHeap () returned 0x580000 [0091.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Particles\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35d3d0be, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1b816, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35dd5a2c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0091.328] GetProcessHeap () returned 0x580000 [0091.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.328] GetProcessHeap () returned 0x580000 [0091.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Pyramid\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35dfbc86, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1c555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35e21edf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0091.328] GetProcessHeap () returned 0x580000 [0091.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Pyramid\\ResPacks\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35e21edf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1d153, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35e21edf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.329] GetProcessHeap () returned 0x580000 [0091.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.329] GetProcessHeap () returned 0x580000 [0091.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.329] GetProcessHeap () returned 0x580000 [0091.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Spider\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35e48142, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1dfdd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35e6e396, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0091.330] GetProcessHeap () returned 0x580000 [0091.330] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Spider\\ResPacks\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35e48142, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1ef18, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35e48142, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0091.331] GetProcessHeap () returned 0x580000 [0091.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.331] GetProcessHeap () returned 0x580000 [0091.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.331] GetProcessHeap () returned 0x580000 [0091.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\Theme\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35e6e396, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1f832, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35f2cf5e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0091.332] GetProcessHeap () returned 0x580000 [0091.332] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.332] GetProcessHeap () returned 0x580000 [0091.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\TriPeaks\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35f531bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf1fefc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35fc58cc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.333] GetProcessHeap () returned 0x580000 [0091.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\GamePlayAssets\\TriPeaks\\ResPacks\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35f531bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf20a89, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x35f531bc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0091.333] GetProcessHeap () returned 0x580000 [0091.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.333] GetProcessHeap () returned 0x580000 [0091.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.334] GetProcessHeap () returned 0x580000 [0091.334] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.334] GetProcessHeap () returned 0x580000 [0091.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.335] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36011d7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xacf21496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x363fa5db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0091.336] GetProcessHeap () returned 0x580000 [0091.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.336] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\DailyChallenges\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36011d7f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad048c46, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3605e236, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.338] GetProcessHeap () returned 0x580000 [0091.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.338] GetProcessHeap () returned 0x580000 [0091.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\FreeCell\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3605e236, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad0b7bdb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x360f6ba4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0091.340] GetProcessHeap () returned 0x580000 [0091.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.340] GetProcessHeap () returned 0x580000 [0091.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\Klondike\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3611cdfe, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad0ba445, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x361db9c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0091.342] GetProcessHeap () returned 0x580000 [0091.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.342] GetProcessHeap () returned 0x580000 [0091.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\Pyramid\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36227e81, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad119406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x362e6a44, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.344] GetProcessHeap () returned 0x580000 [0091.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.344] GetProcessHeap () returned 0x580000 [0091.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\Spider\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3630cca2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad1cdf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x363d4386, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0091.346] GetProcessHeap () returned 0x580000 [0091.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.346] GetProcessHeap () returned 0x580000 [0091.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\StarClub\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x363d4386, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad1ce7fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x363fa5db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0091.347] GetProcessHeap () returned 0x580000 [0091.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.347] GetProcessHeap () returned 0x580000 [0091.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\HowToPlay\\TriPeaks\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x363fa5db, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad1d0ffd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3644e45a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.376] GetProcessHeap () returned 0x580000 [0091.376] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.376] GetProcessHeap () returned 0x580000 [0091.376] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.376] GetProcessHeap () returned 0x580000 [0091.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Icons\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x364746b3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad239fed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3650d026, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0091.379] GetProcessHeap () returned 0x580000 [0091.379] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.379] GetProcessHeap () returned 0x580000 [0091.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Livetiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3650d026, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad2b592c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x365a5990, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0091.381] GetProcessHeap () returned 0x580000 [0091.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.381] GetProcessHeap () returned 0x580000 [0091.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\MainPage\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x365a5990, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3440cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x365cbbe9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0091.383] GetProcessHeap () returned 0x580000 [0091.383] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.383] GetProcessHeap () returned 0x580000 [0091.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\MainPageState2\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x365cbbe9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad346b82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36664553, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0091.386] GetProcessHeap () returned 0x580000 [0091.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.386] GetProcessHeap () returned 0x580000 [0091.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\News\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36664553, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad34763e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36664553, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0091.387] GetProcessHeap () returned 0x580000 [0091.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.387] GetProcessHeap () returned 0x580000 [0091.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\OptInPopup\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3668a7b1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad348156, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3668a7b1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0091.387] GetProcessHeap () returned 0x580000 [0091.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.387] GetProcessHeap () returned 0x580000 [0091.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\PopUp\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x366b0a0a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad348e3e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x366b0a0a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0091.387] GetProcessHeap () returned 0x580000 [0091.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.387] GetProcessHeap () returned 0x580000 [0091.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SampleHeader\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x366fcec2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad349c2a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36723120, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0091.388] GetProcessHeap () returned 0x580000 [0091.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.388] GetProcessHeap () returned 0x580000 [0091.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\SplashScreen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36723120, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3af563, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36749379, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0091.390] GetProcessHeap () returned 0x580000 [0091.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.390] GetProcessHeap () returned 0x580000 [0091.390] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\StarClub\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3676f5d7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b11e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36795830, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0091.392] GetProcessHeap () returned 0x580000 [0091.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.392] GetProcessHeap () returned 0x580000 [0091.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.392] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Statistics\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367bba89, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b1c47, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x367e1ce3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0091.393] GetProcessHeap () returned 0x580000 [0091.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.393] GetProcessHeap () returned 0x580000 [0091.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Store\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36807f40, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad3b269d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36807f40, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0091.393] GetProcessHeap () returned 0x580000 [0091.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.394] GetProcessHeap () returned 0x580000 [0091.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.394] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3682e19a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad463d9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a24610, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0091.395] GetProcessHeap () returned 0x580000 [0091.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.395] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeCreation\\Effects\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x368c6b0d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4dd181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36939219, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0091.397] GetProcessHeap () returned 0x580000 [0091.397] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.397] GetProcessHeap () returned 0x580000 [0091.397] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.398] GetProcessHeap () returned 0x580000 [0091.398] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemeDownload\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a24610, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4ddf83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36a4a88e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.399] GetProcessHeap () returned 0x580000 [0091.399] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.399] GetProcessHeap () returned 0x580000 [0091.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.399] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad4de80d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c3a737, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0091.466] GetProcessHeap () returned 0x580000 [0091.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.466] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Backgrounds\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36a4a88e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad524849, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36abcfa3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0091.469] GetProcessHeap () returned 0x580000 [0091.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.469] GetProcessHeap () returned 0x580000 [0091.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.470] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\CardBacks\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36abcfa3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad56501d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b09456, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0091.472] GetProcessHeap () returned 0x580000 [0091.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.472] GetProcessHeap () returned 0x580000 [0091.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.472] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Effects\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b2f6b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad565f3b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36c144d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.474] GetProcessHeap () returned 0x580000 [0091.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.474] GetProcessHeap () returned 0x580000 [0091.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.474] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\ThemePreview\\Themes\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36c3a737, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad603ea4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36cd309d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0091.476] GetProcessHeap () returned 0x580000 [0091.476] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.476] GetProcessHeap () returned 0x580000 [0091.476] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.477] GetProcessHeap () returned 0x580000 [0091.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36cf92fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad604f5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0091.516] GetProcessHeap () returned 0x580000 [0091.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Aquarium\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36cf92fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad660916, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36db7ebd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.517] GetProcessHeap () returned 0x580000 [0091.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Aquarium\\mask\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36db7ebd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad6bc21d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36e9cce3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.519] GetProcessHeap () returned 0x580000 [0091.519] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.519] GetProcessHeap () returned 0x580000 [0091.519] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.520] GetProcessHeap () returned 0x580000 [0091.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Autumn\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36e9cce3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad6c0df3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36f5b8ab, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0091.522] GetProcessHeap () returned 0x580000 [0091.522] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Autumn\\mask\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36f5b8ab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad73344c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36fcdfbb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.524] GetProcessHeap () returned 0x580000 [0091.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.524] GetProcessHeap () returned 0x580000 [0091.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.525] GetProcessHeap () returned 0x580000 [0091.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Beach\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36ff4214, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad77eea6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x370ff293, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0091.527] GetProcessHeap () returned 0x580000 [0091.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Beach\\mask\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x370ff293, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7cec66, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37197c02, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0091.529] GetProcessHeap () returned 0x580000 [0091.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.529] GetProcessHeap () returned 0x580000 [0091.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.530] GetProcessHeap () returned 0x580000 [0091.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Classic\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x371bde5b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7d10a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3728a569, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.532] GetProcessHeap () returned 0x580000 [0091.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Classic\\mask\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3728a569, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad8a1f96, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x372fcc79, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0091.534] GetProcessHeap () returned 0x580000 [0091.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.534] GetProcessHeap () returned 0x580000 [0091.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.535] GetProcessHeap () returned 0x580000 [0091.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Fable\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x372fcc79, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad912c92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37399629, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0091.537] GetProcessHeap () returned 0x580000 [0091.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.537] GetProcessHeap () returned 0x580000 [0091.537] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Jumbo\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37399629, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad991296, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374581f1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0091.539] GetProcessHeap () returned 0x580000 [0091.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Jumbo\\mask\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374581f1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada1e8d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.541] GetProcessHeap () returned 0x580000 [0091.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.541] GetProcessHeap () returned 0x580000 [0091.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.542] GetProcessHeap () returned 0x580000 [0091.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Mobile\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada1fcdb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x374f1a3e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0091.542] GetProcessHeap () returned 0x580000 [0091.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.542] GetProcessHeap () returned 0x580000 [0091.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Western\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada5d89c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376785a9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0091.544] GetProcessHeap () returned 0x580000 [0091.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Themes\\Western\\mask\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x374f1a3e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xada602f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37593788, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.546] GetProcessHeap () returned 0x580000 [0091.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.546] GetProcessHeap () returned 0x580000 [0091.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.547] GetProcessHeap () returned 0x580000 [0091.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.547] GetProcessHeap () returned 0x580000 [0091.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tiles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3769e802, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb15f48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x376c4a60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0091.550] GetProcessHeap () returned 0x580000 [0091.550] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.550] GetProcessHeap () returned 0x580000 [0091.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.550] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\Tournament\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x376ebbff, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1841a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377d0a4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0091.552] GetProcessHeap () returned 0x580000 [0091.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.552] GetProcessHeap () returned 0x580000 [0091.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxControl\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377d0a4a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19197, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.552] GetProcessHeap () returned 0x580000 [0091.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.552] GetProcessHeap () returned 0x580000 [0091.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0091.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Assets\\XboxFlow\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x377f6ca3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb19d17, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x377f6ca3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0091.552] GetProcessHeap () returned 0x580000 [0091.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0091.553] GetProcessHeap () returned 0x580000 [0091.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.553] GetProcessHeap () returned 0x580000 [0091.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ac8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0091.585] GetProcessHeap () returned 0x580000 [0091.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\Avatars\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37974437, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1bdb7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37974437, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.585] GetProcessHeap () returned 0x580000 [0091.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.585] GetProcessHeap () returned 0x580000 [0091.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.585] GetProcessHeap () returned 0x580000 [0091.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc96ea5b4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdae86288, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xdae86288, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0091.585] GetProcessHeap () returned 0x580000 [0091.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.585] GetProcessHeap () returned 0x580000 [0091.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1ce25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.586] GetProcessHeap () returned 0x580000 [0091.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d39d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.586] GetProcessHeap () returned 0x580000 [0091.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\Shaders\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1d9b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37e86909, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0091.587] GetProcessHeap () returned 0x580000 [0091.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0091.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\Shaders\\Builtin\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb1de6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ef901a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0091.588] GetProcessHeap () returned 0x580000 [0091.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0091.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\Shaders\\Builtin\\Bin\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37e86909, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadb98b45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37ef901a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0091.591] GetProcessHeap () returned 0x580000 [0091.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0091.591] GetProcessHeap () returned 0x580000 [0091.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x203a0050 [0091.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\SharpDXEngine\\Rendering\\Shaders\\Builtin\\HLSL\\*", lpFindFileData=0x1fb9e860 | out: lpFindFileData=0x1fb9e860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37ef901a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadbfe34d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37f709ad, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0091.593] GetProcessHeap () returned 0x580000 [0091.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x203a0050 | out: hHeap=0x580000) returned 1 [0091.594] GetProcessHeap () returned 0x580000 [0091.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0091.595] GetProcessHeap () returned 0x580000 [0091.595] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.595] GetProcessHeap () returned 0x580000 [0091.595] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.596] GetProcessHeap () returned 0x580000 [0091.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.596] GetProcessHeap () returned 0x580000 [0091.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34110fcc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xabf2fada, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3421c04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.598] GetProcessHeap () returned 0x580000 [0091.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.598] GetProcessHeap () returned 0x580000 [0091.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0091.598] GetProcessHeap () returned 0x580000 [0091.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0091.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a98e846, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb314296, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb314296, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0091.602] GetProcessHeap () returned 0x580000 [0091.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a9dacf8, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc94d2f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6aa271af, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0091.605] GetProcessHeap () returned 0x580000 [0091.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.605] GetProcessHeap () returned 0x580000 [0091.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb314296, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb314296, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb314296, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.609] GetProcessHeap () returned 0x580000 [0091.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.609] GetProcessHeap () returned 0x580000 [0091.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0091.610] GetProcessHeap () returned 0x580000 [0091.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0091.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0091.614] GetProcessHeap () returned 0x580000 [0091.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69c2543c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6c838, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69c2543c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.615] GetProcessHeap () returned 0x580000 [0091.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.615] GetProcessHeap () returned 0x580000 [0091.615] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.620] GetProcessHeap () returned 0x580000 [0091.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.620] GetProcessHeap () returned 0x580000 [0091.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0091.621] GetProcessHeap () returned 0x580000 [0091.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0091.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e152fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcb2ee04f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcb2ee04f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0091.625] GetProcessHeap () returned 0x580000 [0091.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e3b535, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6eb7b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e3b535, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.727] GetProcessHeap () returned 0x580000 [0091.727] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.727] GetProcessHeap () returned 0x580000 [0091.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e879ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf87aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69efa0fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.730] GetProcessHeap () returned 0x580000 [0091.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.730] GetProcessHeap () returned 0x580000 [0091.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.730] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddf973d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0091.730] GetProcessHeap () returned 0x580000 [0091.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Microsoft.StickyNotes.Views\\Images\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8a9a20, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfa4dd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8a9a20, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.731] GetProcessHeap () returned 0x580000 [0091.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.731] GetProcessHeap () returned 0x580000 [0091.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.732] GetProcessHeap () returned 0x580000 [0091.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.732] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcb2ee04f, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd8b5b46d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd8b5b46d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0091.733] GetProcessHeap () returned 0x580000 [0091.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.733] GetProcessHeap () returned 0x580000 [0091.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a8cfc83, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaddfb0cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6a8cfc83, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0091.733] GetProcessHeap () returned 0x580000 [0091.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.733] GetProcessHeap () returned 0x580000 [0091.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69e61793, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadd6e3ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69e61793, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0091.843] GetProcessHeap () returned 0x580000 [0091.846] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.846] GetProcessHeap () returned 0x580000 [0091.846] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0091.881] GetProcessHeap () returned 0x580000 [0091.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0091.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0091.886] GetProcessHeap () returned 0x580000 [0091.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa16112ba, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadea87cd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa16112ba, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0091.892] GetProcessHeap () returned 0x580000 [0091.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.892] GetProcessHeap () returned 0x580000 [0091.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.892] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0091.898] GetProcessHeap () returned 0x580000 [0091.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.898] GetProcessHeap () returned 0x580000 [0091.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0091.898] GetProcessHeap () returned 0x580000 [0091.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0091.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa17daefc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0091.901] GetProcessHeap () returned 0x580000 [0091.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1801155, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeaa4f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa18273b3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0091.901] GetProcessHeap () returned 0x580000 [0091.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0091.901] GetProcessHeap () returned 0x580000 [0091.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0091.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa18273b3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeab676, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f98f1f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0091.903] GetProcessHeap () returned 0x580000 [0091.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa18273b3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeac2bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa18273b3, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0091.904] GetProcessHeap () returned 0x580000 [0091.904] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.904] GetProcessHeap () returned 0x580000 [0091.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.904] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Images\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa184d60c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadeacbdb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa184d60c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0091.906] GetProcessHeap () returned 0x580000 [0091.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Stickers\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa184d60c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadff5e06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa1e1d1ec, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0091.912] GetProcessHeap () returned 0x580000 [0091.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x20390048 [0091.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Images\\Stickers\\Thumbnails\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1e1d1ec, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae053910, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2937ee9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.964] GetProcessHeap () returned 0x580000 [0091.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x20390048 | out: hHeap=0x580000) returned 1 [0091.964] GetProcessHeap () returned 0x580000 [0091.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.965] GetProcessHeap () returned 0x580000 [0091.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0091.966] GetProcessHeap () returned 0x580000 [0091.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0091.966] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29843a0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae054a1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2eff0ed, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0091.967] GetProcessHeap () returned 0x580000 [0091.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\BadgeLogo\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29843a0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae12b3bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa29d0853, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0091.969] GetProcessHeap () returned 0x580000 [0091.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.970] GetProcessHeap () returned 0x580000 [0091.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\SplashScreen\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa29d0853, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae1f1d1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2b01b2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.974] GetProcessHeap () returned 0x580000 [0091.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.974] GetProcessHeap () returned 0x580000 [0091.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.974] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\Square150x150\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2b01b2f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae1f47d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2caac59, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0091.977] GetProcessHeap () returned 0x580000 [0091.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.977] GetProcessHeap () returned 0x580000 [0091.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.977] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\Square310x310\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2cafa91, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae2671bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2cfbf72, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0091.980] GetProcessHeap () returned 0x580000 [0091.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0091.980] GetProcessHeap () returned 0x580000 [0091.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0091.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\Square44x44\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2d221c7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae268742, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2e586d2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0092.028] GetProcessHeap () returned 0x580000 [0092.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0092.028] GetProcessHeap () returned 0x580000 [0092.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0092.028] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\Square71x71\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e586d2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae26a4c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2e7e910, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0092.151] GetProcessHeap () returned 0x580000 [0092.151] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0092.151] GetProcessHeap () returned 0x580000 [0092.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0092.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\StoreLogo\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2eb2c15, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae2b9598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2ed8e94, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0092.153] GetProcessHeap () returned 0x580000 [0092.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0092.153] GetProcessHeap () returned 0x580000 [0092.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0092.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Logos\\Wide310x150\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2eff0ed, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae32081c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f4b5a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.155] GetProcessHeap () returned 0x580000 [0092.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0092.155] GetProcessHeap () returned 0x580000 [0092.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.156] GetProcessHeap () returned 0x580000 [0092.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\PDP\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f72ca1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae32171a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f72ca1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0092.157] GetProcessHeap () returned 0x580000 [0092.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.157] GetProcessHeap () returned 0x580000 [0092.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Videos\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f98f1f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae321d67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2f98f1f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.157] GetProcessHeap () returned 0x580000 [0092.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0092.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Assets\\Videos\\Help\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2f98f1f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae3225d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa2fe53db, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0092.158] GetProcessHeap () returned 0x580000 [0092.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0092.158] GetProcessHeap () returned 0x580000 [0092.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.158] GetProcessHeap () returned 0x580000 [0092.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.158] GetProcessHeap () returned 0x580000 [0092.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\Content\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30ca1fc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae322e08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa30ca1fc, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0092.159] GetProcessHeap () returned 0x580000 [0092.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.159] GetProcessHeap () returned 0x580000 [0092.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\CoreEngine\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30f045a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae32349e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa30f045a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0092.159] GetProcessHeap () returned 0x580000 [0092.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\CoreEngine\\Data\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30f045a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae323c6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa31af01d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0092.160] GetProcessHeap () returned 0x580000 [0092.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0092.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\CoreEngine\\Data\\3DBrush\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa30f045a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae3c2040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa313c90c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0092.162] GetProcessHeap () returned 0x580000 [0092.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0092.162] GetProcessHeap () returned 0x580000 [0092.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0092.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\CoreEngine\\Data\\BrushProfile\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3162b66, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae3c32ff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa3162b66, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0092.162] GetProcessHeap () returned 0x580000 [0092.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0092.162] GetProcessHeap () returned 0x580000 [0092.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.163] GetProcessHeap () returned 0x580000 [0092.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.163] GetProcessHeap () returned 0x580000 [0092.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xcd2853a0, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xcd2853a0, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xcd2853a0, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0092.164] GetProcessHeap () returned 0x580000 [0092.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.164] GetProcessHeap () returned 0x580000 [0092.164] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\\SurfaceProfiles\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa442943f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae416fc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa4580975, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0092.166] GetProcessHeap () returned 0x580000 [0092.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.167] GetProcessHeap () returned 0x580000 [0092.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.167] GetProcessHeap () returned 0x580000 [0092.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21852be, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c23b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69869570, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.169] GetProcessHeap () returned 0x580000 [0092.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb21ab500, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae4c3e79, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb21ab500, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0092.170] GetProcessHeap () returned 0x580000 [0092.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.170] GetProcessHeap () returned 0x580000 [0092.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69869570, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0092.170] GetProcessHeap () returned 0x580000 [0092.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd88c5fc4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd88c5fc4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd88c5fc4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0092.172] GetProcessHeap () returned 0x580000 [0092.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.172] GetProcessHeap () returned 0x580000 [0092.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.173] GetProcessHeap () returned 0x580000 [0092.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.173] GetProcessHeap () returned 0x580000 [0092.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb23e79d9, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae58079f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69b6448c, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0092.174] GetProcessHeap () returned 0x580000 [0092.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb240dc54, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae5814c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb240dc54, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.175] GetProcessHeap () returned 0x580000 [0092.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.175] GetProcessHeap () returned 0x580000 [0092.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69b6448c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd9da2999, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd9da2999, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0092.175] GetProcessHeap () returned 0x580000 [0092.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9da2999, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd9da2999, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd9da2999, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0092.177] GetProcessHeap () returned 0x580000 [0092.177] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.177] GetProcessHeap () returned 0x580000 [0092.177] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.178] GetProcessHeap () returned 0x580000 [0092.178] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.178] GetProcessHeap () returned 0x580000 [0092.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae61172a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c39f778, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0092.180] GetProcessHeap () returned 0x580000 [0092.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f97eba2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae6123e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4f97eba2, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0092.180] GetProcessHeap () returned 0x580000 [0092.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.180] GetProcessHeap () returned 0x580000 [0092.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c39f778, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdae53146, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdae53146, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0092.180] GetProcessHeap () returned 0x580000 [0092.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdae53146, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x12ce6df5, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x12ce6df5, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0092.181] GetProcessHeap () returned 0x580000 [0092.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.181] GetProcessHeap () returned 0x580000 [0092.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.182] GetProcessHeap () returned 0x580000 [0092.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.182] GetProcessHeap () returned 0x580000 [0092.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae652687, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5be1c081, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.185] GetProcessHeap () returned 0x580000 [0092.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fbe1144, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae653223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4fbe1144, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0092.185] GetProcessHeap () returned 0x580000 [0092.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.185] GetProcessHeap () returned 0x580000 [0092.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5be1c081, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdb90dade, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb90dade, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0092.186] GetProcessHeap () returned 0x580000 [0092.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.1_1.0.23115.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb90dade, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd257af62, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd257af62, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0092.187] GetProcessHeap () returned 0x580000 [0092.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.187] GetProcessHeap () returned 0x580000 [0092.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.188] GetProcessHeap () returned 0x580000 [0092.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.188] GetProcessHeap () returned 0x580000 [0092.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x569db5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb046ec20, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0092.313] GetProcessHeap () returned 0x580000 [0092.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6267, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae6c9f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6267, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0092.314] GetProcessHeap () returned 0x580000 [0092.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.314] GetProcessHeap () returned 0x580000 [0092.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb046ec20, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb046ec20, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdb9fcec, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0092.315] GetProcessHeap () returned 0x580000 [0092.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdb79a84, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdb79a84, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdb9fcec, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0092.315] GetProcessHeap () returned 0x580000 [0092.316] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.316] GetProcessHeap () returned 0x580000 [0092.316] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.316] GetProcessHeap () returned 0x580000 [0092.316] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.316] GetProcessHeap () returned 0x580000 [0092.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf855c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaf7c444d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0092.318] GetProcessHeap () returned 0x580000 [0092.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc44a0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae726a29, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc44a0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0092.319] GetProcessHeap () returned 0x580000 [0092.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.319] GetProcessHeap () returned 0x580000 [0092.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.319] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xaf7c444d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaf7c444d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0092.319] GetProcessHeap () returned 0x580000 [0092.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.3_1.3.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd96398a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd96398a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd96398a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0092.320] GetProcessHeap () returned 0x580000 [0092.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.321] GetProcessHeap () returned 0x580000 [0092.321] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.321] GetProcessHeap () returned 0x580000 [0092.321] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.321] GetProcessHeap () returned 0x580000 [0092.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x115e8dfa, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e244c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x12f3e2a7, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0092.323] GetProcessHeap () returned 0x580000 [0092.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11909f6c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae7e4415, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x11909f6c, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0092.324] GetProcessHeap () returned 0x580000 [0092.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.324] GetProcessHeap () returned 0x580000 [0092.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x12f3e2a7, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdbfe8744, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdbfe8744, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.325] GetProcessHeap () returned 0x580000 [0092.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdbfe8744, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8c8ab51, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8c8ab51, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0092.326] GetProcessHeap () returned 0x580000 [0092.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.326] GetProcessHeap () returned 0x580000 [0092.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.327] GetProcessHeap () returned 0x580000 [0092.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.327] GetProcessHeap () returned 0x580000 [0092.327] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13f7c62e, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae87e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x164e3d2d, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0092.328] GetProcessHeap () returned 0x580000 [0092.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14120099, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xae88003f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x14120099, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.329] GetProcessHeap () returned 0x580000 [0092.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.329] GetProcessHeap () returned 0x580000 [0092.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x164e3d2d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdc925941, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdc925941, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0092.330] GetProcessHeap () returned 0x580000 [0092.330] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Framework.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdc925941, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8e2e542, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8e2e542, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0092.331] GetProcessHeap () returned 0x580000 [0092.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.331] GetProcessHeap () returned 0x580000 [0092.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.331] GetProcessHeap () returned 0x580000 [0092.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.331] GetProcessHeap () returned 0x580000 [0092.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26701cd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae8ff986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69da07d7, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0092.333] GetProcessHeap () returned 0x580000 [0092.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2696342, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae900a2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2696342, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0092.333] GetProcessHeap () returned 0x580000 [0092.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.333] GetProcessHeap () returned 0x580000 [0092.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.333] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69da07d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0092.334] GetProcessHeap () returned 0x580000 [0092.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdd0e53b5, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdd0e53b5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdd0e53b5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0092.336] GetProcessHeap () returned 0x580000 [0092.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.336] GetProcessHeap () returned 0x580000 [0092.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.337] GetProcessHeap () returned 0x580000 [0092.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.337] GetProcessHeap () returned 0x580000 [0092.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb26e2784, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b674b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x69fb68e3, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0092.341] GetProcessHeap () returned 0x580000 [0092.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2708a61, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xae9b8a01, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2708a61, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0092.341] GetProcessHeap () returned 0x580000 [0092.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.341] GetProcessHeap () returned 0x580000 [0092.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x69fb68e3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.341] GetProcessHeap () returned 0x580000 [0092.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xddc386b4, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xddc386b4, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xddc386b4, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0092.345] GetProcessHeap () returned 0x580000 [0092.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.345] GetProcessHeap () returned 0x580000 [0092.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.346] GetProcessHeap () returned 0x580000 [0092.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.346] GetProcessHeap () returned 0x580000 [0092.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff4e801, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea38daa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c77f49b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.348] GetProcessHeap () returned 0x580000 [0092.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ff74b34, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaea3adf2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ff74b34, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0092.349] GetProcessHeap () returned 0x580000 [0092.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.349] GetProcessHeap () returned 0x580000 [0092.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c77f49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xde4445ea, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xde4445ea, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.349] GetProcessHeap () returned 0x580000 [0092.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xde4445ea, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28c236f, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28c236f, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0092.350] GetProcessHeap () returned 0x580000 [0092.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.350] GetProcessHeap () returned 0x580000 [0092.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.351] GetProcessHeap () returned 0x580000 [0092.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.351] GetProcessHeap () returned 0x580000 [0092.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf585c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5c58f618, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0092.352] GetProcessHeap () returned 0x580000 [0092.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ffc0fdc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaeaf6ce9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4ffc0fdc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0092.353] GetProcessHeap () returned 0x580000 [0092.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.353] GetProcessHeap () returned 0x580000 [0092.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5c58f618, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xdefbdb44, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdefbdb44, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0092.354] GetProcessHeap () returned 0x580000 [0092.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.1_1.1.23118.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdefbdb44, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd28e85c8, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd28e85c8, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0092.354] GetProcessHeap () returned 0x580000 [0092.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.355] GetProcessHeap () returned 0x580000 [0092.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.355] GetProcessHeap () returned 0x580000 [0092.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.579] GetProcessHeap () returned 0x580000 [0092.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1096e68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xae30dca7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xae30dca7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0092.581] GetProcessHeap () returned 0x580000 [0092.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e331a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaeb8d82b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x10e331a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0092.584] GetProcessHeap () returned 0x580000 [0092.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.584] GetProcessHeap () returned 0x580000 [0092.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xae30dca7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xae30dca7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd51152b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0092.585] GetProcessHeap () returned 0x580000 [0092.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.586] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd51152b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd51152b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd51152b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0092.586] GetProcessHeap () returned 0x580000 [0092.586] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.587] GetProcessHeap () returned 0x580000 [0092.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.587] GetProcessHeap () returned 0x580000 [0092.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.587] GetProcessHeap () returned 0x580000 [0092.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11c813b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad7e0bf4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad7e0bf4, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0092.590] GetProcessHeap () returned 0x580000 [0092.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1260aaa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaec89e61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1260aaa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0092.591] GetProcessHeap () returned 0x580000 [0092.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.591] GetProcessHeap () returned 0x580000 [0092.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.591] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xad7e0bf4, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xad7e0bf4, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd478c3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0092.591] GetProcessHeap () returned 0x580000 [0092.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.592] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd478c3a, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd478c3a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd478c3a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0092.592] GetProcessHeap () returned 0x580000 [0092.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.592] GetProcessHeap () returned 0x580000 [0092.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.593] GetProcessHeap () returned 0x580000 [0092.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.593] GetProcessHeap () returned 0x580000 [0092.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.593] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f6d5e4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xad0dfe61, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xad0dfe61, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0092.594] GetProcessHeap () returned 0x580000 [0092.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f93841, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaecdd562, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33f93841, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0092.594] GetProcessHeap () returned 0x580000 [0092.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.595] GetProcessHeap () returned 0x580000 [0092.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xad0dfe61, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xad0dfe61, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd64283b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.595] GetProcessHeap () returned 0x580000 [0092.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.596] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd61c5d8, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd61c5d8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd6b4f3c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0092.596] GetProcessHeap () returned 0x580000 [0092.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.596] GetProcessHeap () returned 0x580000 [0092.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.597] GetProcessHeap () returned 0x580000 [0092.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.597] GetProcessHeap () returned 0x580000 [0092.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fb9a9b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaca2b3ac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xaca2b3ac, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0092.599] GetProcessHeap () returned 0x580000 [0092.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fdfcf4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaed7d57f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x33fdfcf4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0092.599] GetProcessHeap () returned 0x580000 [0092.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.599] GetProcessHeap () returned 0x580000 [0092.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xaca2b3ac, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xaca2b3ac, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd40665d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0092.600] GetProcessHeap () returned 0x580000 [0092.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd40665d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd40665d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xd40665d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0092.601] GetProcessHeap () returned 0x580000 [0092.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.601] GetProcessHeap () returned 0x580000 [0092.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.601] GetProcessHeap () returned 0x580000 [0092.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.601] GetProcessHeap () returned 0x580000 [0092.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b404f13, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaee25a0f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1c25330e, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.603] GetProcessHeap () returned 0x580000 [0092.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b667506, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaee2755c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1b68d6c9, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0092.603] GetProcessHeap () returned 0x580000 [0092.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.603] GetProcessHeap () returned 0x580000 [0092.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1c25330e, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdf70aeab, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdf70aeab, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0092.604] GetProcessHeap () returned 0x580000 [0092.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdf70aeab, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa8fd1f17, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa8fd1f17, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0092.605] GetProcessHeap () returned 0x580000 [0092.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.605] GetProcessHeap () returned 0x580000 [0092.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.606] GetProcessHeap () returned 0x580000 [0092.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.606] GetProcessHeap () returned 0x580000 [0092.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ac94c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaef00b37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1dc41199, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0092.608] GetProcessHeap () returned 0x580000 [0092.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d3c29bb, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaef031dc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1d3c29bb, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0092.609] GetProcessHeap () returned 0x580000 [0092.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.609] GetProcessHeap () returned 0x580000 [0092.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1dc41199, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xdfdbf898, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfdbf898, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0092.609] GetProcessHeap () returned 0x580000 [0092.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0092.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.NET.Native.Runtime.1.6_1.6.24903.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfdbf898, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa904464d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa904464d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.611] GetProcessHeap () returned 0x580000 [0092.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0092.611] GetProcessHeap () returned 0x580000 [0092.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.611] GetProcessHeap () returned 0x580000 [0092.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.611] GetProcessHeap () returned 0x580000 [0092.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd44a8 [0092.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59460ee7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1ed095d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1ed095d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0092.613] GetProcessHeap () returned 0x580000 [0092.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\animations\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x595b8410, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaef96f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x597b1fa2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0092.795] GetProcessHeap () returned 0x580000 [0092.796] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.796] GetProcessHeap () returned 0x580000 [0092.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594ad391, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaef981fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x594ad391, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0092.797] GetProcessHeap () returned 0x580000 [0092.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.797] GetProcessHeap () returned 0x580000 [0092.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\en-gb\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59b93c35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf014f53, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59c527fd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0092.799] GetProcessHeap () returned 0x580000 [0092.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.799] GetProcessHeap () returned 0x580000 [0092.799] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\en-us\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c527fd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf0838ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e1c43f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0092.801] GetProcessHeap () returned 0x580000 [0092.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\en-us\\jscripts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c9ecb4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf084920, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59c9ecb4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0092.803] GetProcessHeap () returned 0x580000 [0092.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.803] GetProcessHeap () returned 0x580000 [0092.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\en-us\\pages\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e1c43f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf085638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e1c43f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0092.803] GetProcessHeap () returned 0x580000 [0092.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.803] GetProcessHeap () returned 0x580000 [0092.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\en-us\\styles\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e1c43f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf0862ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e4269d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0092.804] GetProcessHeap () returned 0x580000 [0092.804] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.804] GetProcessHeap () returned 0x580000 [0092.804] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.805] GetProcessHeap () returned 0x580000 [0092.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\font\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e4269d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf086b6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e4269d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.806] GetProcessHeap () returned 0x580000 [0092.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.806] GetProcessHeap () returned 0x580000 [0092.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\fonts\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e4269d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf0873c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x59e4269d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0092.806] GetProcessHeap () returned 0x580000 [0092.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.806] GetProcessHeap () returned 0x580000 [0092.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a00c2e3, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf19691b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6b3675, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0092.814] GetProcessHeap () returned 0x580000 [0092.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\images\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a8f7f56, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf27329f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5acfe8e6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0092.820] GetProcessHeap () returned 0x580000 [0092.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.820] GetProcessHeap () returned 0x580000 [0092.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.820] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\images\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5acfe8e6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf35a206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b07f008, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0092.826] GetProcessHeap () returned 0x580000 [0092.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.829] GetProcessHeap () returned 0x580000 [0092.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\images\\osf\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b665011, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b3b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6b3675, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0092.831] GetProcessHeap () returned 0x580000 [0092.831] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.831] GetProcessHeap () returned 0x580000 [0092.831] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.832] GetProcessHeap () returned 0x580000 [0092.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\jscripts\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6b3675, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b4e8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6d8db2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.832] GetProcessHeap () returned 0x580000 [0092.832] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.832] GetProcessHeap () returned 0x580000 [0092.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\manifests\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b6d8db2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b57d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6d8db2, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3a0 [0092.833] GetProcessHeap () returned 0x580000 [0092.833] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.833] GetProcessHeap () returned 0x580000 [0092.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd1ed095d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd1ed095d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1ed095d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1e0 [0092.834] GetProcessHeap () returned 0x580000 [0092.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.834] GetProcessHeap () returned 0x580000 [0092.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\pages\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5db81172, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b6b86, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5db81172, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0092.834] GetProcessHeap () returned 0x580000 [0092.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.834] GetProcessHeap () returned 0x580000 [0092.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\sr-cyrl-cs\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dde3722, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b7384, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5dde3722, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.835] GetProcessHeap () returned 0x580000 [0092.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.835] GetProcessHeap () returned 0x580000 [0092.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\sr-latn-cs\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5dde3722, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b7fcf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5dde3722, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0092.835] GetProcessHeap () returned 0x580000 [0092.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.835] GetProcessHeap () returned 0x580000 [0092.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff80068 [0092.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\xaml\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de0997c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf3b8a1c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5de0997c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2e0 [0092.835] GetProcessHeap () returned 0x580000 [0092.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\\xaml\\onenote\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5de0997c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf435cd5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5dea7b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0092.837] GetProcessHeap () returned 0x580000 [0092.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.838] GetProcessHeap () returned 0x580000 [0092.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ff80068 | out: hHeap=0x580000) returned 1 [0092.838] GetProcessHeap () returned 0x580000 [0092.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd44a8 | out: hHeap=0x580000) returned 1 [0092.982] GetProcessHeap () returned 0x580000 [0092.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0092.983] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58fa379e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd1eaa713, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1eaa713, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0092.984] GetProcessHeap () returned 0x580000 [0092.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0092.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58fa379e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaf4f3df1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x58fa379e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0092.984] GetProcessHeap () returned 0x580000 [0092.984] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0092.984] GetProcessHeap () returned 0x580000 [0092.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0092.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.OneNote_2015.7668.58071.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd1eaa713, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd1eaa713, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd1eaa713, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0092.985] GetProcessHeap () returned 0x580000 [0092.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0092.985] GetProcessHeap () returned 0x580000 [0092.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0092.985] GetProcessHeap () returned 0x580000 [0092.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0092.986] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa599a57e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf561945, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e6321cd, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0092.988] GetProcessHeap () returned 0x580000 [0092.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0092.988] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa599a57e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf5639e6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa599a57e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0092.989] GetProcessHeap () returned 0x580000 [0092.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0092.989] GetProcessHeap () returned 0x580000 [0092.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0092.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa59c07d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf5645f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa59c07d4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.989] GetProcessHeap () returned 0x580000 [0092.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0092.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\Assets\\WebPlayer\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa59c07d4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf5e05e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa5da4145, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0092.993] GetProcessHeap () returned 0x580000 [0092.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0092.993] GetProcessHeap () returned 0x580000 [0092.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0092.994] GetProcessHeap () returned 0x580000 [0092.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0092.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\en-us\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa602cafb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf65cc53, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa611194e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0092.996] GetProcessHeap () returned 0x580000 [0092.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0092.996] GetProcessHeap () returned 0x580000 [0092.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0092.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\fonts\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa611194e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf65eae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa611194e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0092.997] GetProcessHeap () returned 0x580000 [0092.997] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0092.997] GetProcessHeap () returned 0x580000 [0092.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0092.997] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa611194e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf75f944, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6794654, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0093.001] GetProcessHeap () returned 0x580000 [0093.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\images\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa62b52e7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf83e928, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6373eb6, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.005] GetProcessHeap () returned 0x580000 [0093.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.005] GetProcessHeap () returned 0x580000 [0093.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\images\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6373eb6, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d0215, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa644c9ea, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0093.007] GetProcessHeap () returned 0x580000 [0093.007] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.009] GetProcessHeap () returned 0x580000 [0093.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.009] GetProcessHeap () returned 0x580000 [0093.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e6321cd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaf8d1431, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e6321cd, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0093.010] GetProcessHeap () returned 0x580000 [0093.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.010] GetProcessHeap () returned 0x580000 [0093.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\storyclientui_xaml\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa786af81, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d1b15, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa786af81, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.010] GetProcessHeap () returned 0x580000 [0093.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\storyclientui_xaml\\view\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa786af81, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d21fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78911fc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0093.011] GetProcessHeap () returned 0x580000 [0093.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\storyclientui_xaml\\view\\landing\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa786af81, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d2741, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78911fc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0093.011] GetProcessHeap () returned 0x580000 [0093.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.011] GetProcessHeap () returned 0x580000 [0093.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\storyclientui_xaml\\view\\shared\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa78911fc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf8d2bfe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78911fc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0093.012] GetProcessHeap () returned 0x580000 [0093.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.012] GetProcessHeap () returned 0x580000 [0093.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.012] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\storyclientui_xaml\\view\\story\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa78911fc, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf943e43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa78b7317, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0093.014] GetProcessHeap () returned 0x580000 [0093.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.014] GetProcessHeap () returned 0x580000 [0093.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.014] GetProcessHeap () returned 0x580000 [0093.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.014] GetProcessHeap () returned 0x580000 [0093.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\xaml\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7c24a57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf945b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa7c24a57, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0093.014] GetProcessHeap () returned 0x580000 [0093.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\xaml\\mso\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7c24a57, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaf9b0041, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa7c4acb9, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0093.017] GetProcessHeap () returned 0x580000 [0093.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.017] GetProcessHeap () returned 0x580000 [0093.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.017] GetProcessHeap () returned 0x580000 [0093.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.018] GetProcessHeap () returned 0x580000 [0093.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa57d3c26, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xafabb342, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e60bed5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0093.020] GetProcessHeap () returned 0x580000 [0093.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa57d3c26, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xafabc4b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa57d3c26, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0093.020] GetProcessHeap () returned 0x580000 [0093.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.020] GetProcessHeap () returned 0x580000 [0093.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e60bed5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xafabcf70, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6e60bed5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0093.020] GetProcessHeap () returned 0x580000 [0093.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.021] GetProcessHeap () returned 0x580000 [0093.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.021] GetProcessHeap () returned 0x580000 [0093.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ef508f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0093.092] GetProcessHeap () returned 0x580000 [0093.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2000117, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafabf4fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21c9d54, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0093.094] GetProcessHeap () returned 0x580000 [0093.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2000117, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafb54c83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2072835, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0093.096] GetProcessHeap () returned 0x580000 [0093.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.096] GetProcessHeap () returned 0x580000 [0093.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2072835, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafbab880, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x210b18c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0093.098] GetProcessHeap () returned 0x580000 [0093.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.098] GetProcessHeap () returned 0x580000 [0093.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.099] GetProcessHeap () returned 0x580000 [0093.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd45db281, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0093.102] GetProcessHeap () returned 0x580000 [0093.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.102] GetProcessHeap () returned 0x580000 [0093.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.102] GetProcessHeap () returned 0x580000 [0093.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f76a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.104] GetProcessHeap () returned 0x580000 [0093.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4f76a4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafbae931, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4f76a4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0093.121] GetProcessHeap () returned 0x580000 [0093.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.122] GetProcessHeap () returned 0x580000 [0093.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.122] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd45db281, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0093.122] GetProcessHeap () returned 0x580000 [0093.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.122] GetProcessHeap () returned 0x580000 [0093.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.123] GetProcessHeap () returned 0x580000 [0093.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.123] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16dc6f6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd45db281, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd45db281, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0093.125] GetProcessHeap () returned 0x580000 [0093.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x170294f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafbb05d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x170294f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0093.125] GetProcessHeap () returned 0x580000 [0093.125] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.125] GetProcessHeap () returned 0x580000 [0093.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.125] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x170294f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafbf828d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1b3b5a8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0093.126] GetProcessHeap () returned 0x580000 [0093.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x170294f, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafbfa501, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x18645b9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0093.129] GetProcessHeap () returned 0x580000 [0093.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.129] GetProcessHeap () returned 0x580000 [0093.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18645b9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafc4ec6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x19e1d44, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0093.131] GetProcessHeap () returned 0x580000 [0093.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.131] GetProcessHeap () returned 0x580000 [0093.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.132] GetProcessHeap () returned 0x580000 [0093.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd45db281, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd5bf8796, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd5bf8796, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0093.132] GetProcessHeap () returned 0x580000 [0093.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.132] GetProcessHeap () returned 0x580000 [0093.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.133] GetProcessHeap () returned 0x580000 [0093.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x255053c0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0093.135] GetProcessHeap () returned 0x580000 [0093.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25557698, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafc5120a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2564079d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0093.138] GetProcessHeap () returned 0x580000 [0093.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25557698, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafcf43cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x255a7e0e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.140] GetProcessHeap () returned 0x580000 [0093.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.141] GetProcessHeap () returned 0x580000 [0093.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x255a7e0e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafd6c55f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x255f42ea, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0093.142] GetProcessHeap () returned 0x580000 [0093.142] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.143] GetProcessHeap () returned 0x580000 [0093.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.143] GetProcessHeap () returned 0x580000 [0093.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.143] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd61ded48, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0093.143] GetProcessHeap () returned 0x580000 [0093.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.143] GetProcessHeap () returned 0x580000 [0093.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.144] GetProcessHeap () returned 0x580000 [0093.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2499f315, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0093.167] GetProcessHeap () returned 0x580000 [0093.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249c5573, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafd6f7c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x249c5573, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0093.168] GetProcessHeap () returned 0x580000 [0093.168] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.168] GetProcessHeap () returned 0x580000 [0093.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249eb7cc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafdc1431, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x24bc56a8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0093.169] GetProcessHeap () returned 0x580000 [0093.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\Assets\\contrast-black\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249eb7cc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafe104e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x24a5dedd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0093.172] GetProcessHeap () returned 0x580000 [0093.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.172] GetProcessHeap () returned 0x580000 [0093.172] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\Assets\\contrast-white\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24a5dedd, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafe13300, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x24ad5f3c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0093.174] GetProcessHeap () returned 0x580000 [0093.174] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.174] GetProcessHeap () returned 0x580000 [0093.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\Assets\\Fonts\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24ad5f3c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafe13de4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x24ad5f3c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0093.175] GetProcessHeap () returned 0x580000 [0093.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.175] GetProcessHeap () returned 0x580000 [0093.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\Assets\\Sounds\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b52f97, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafe1485b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x24bc56a8, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0093.175] GetProcessHeap () returned 0x580000 [0093.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.175] GetProcessHeap () returned 0x580000 [0093.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.176] GetProcessHeap () returned 0x580000 [0093.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd61ded48, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd442d6fc, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xd442d6fc, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0093.178] GetProcessHeap () returned 0x580000 [0093.178] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.178] GetProcessHeap () returned 0x580000 [0093.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\Strings\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25492ca6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafe15ed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x25492ca6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0093.178] GetProcessHeap () returned 0x580000 [0093.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\Strings\\en-US\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x25492ca6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafe16ee0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x25492ca6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0093.181] GetProcessHeap () returned 0x580000 [0093.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.181] GetProcessHeap () returned 0x580000 [0093.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.181] GetProcessHeap () returned 0x580000 [0093.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_10.1.10531.0_x64__8wekyb3d8bbwe\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x249c5573, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafd6f1ac, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x249c5573, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0093.182] GetProcessHeap () returned 0x580000 [0093.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.182] GetProcessHeap () returned 0x580000 [0093.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.183] GetProcessHeap () returned 0x580000 [0093.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x248ba4f4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0093.185] GetProcessHeap () returned 0x580000 [0093.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x248ba4f4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xafe6e80a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x248ba4f4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0093.185] GetProcessHeap () returned 0x580000 [0093.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.185] GetProcessHeap () returned 0x580000 [0093.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.People_2017.222.1920.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd61ded48, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xd61ded48, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xd61ded48, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0093.186] GetProcessHeap () returned 0x580000 [0093.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.186] GetProcessHeap () returned 0x580000 [0093.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.187] GetProcessHeap () returned 0x580000 [0093.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x367c081d, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xaff5073a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x37eb3642, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.189] GetProcessHeap () returned 0x580000 [0093.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.190] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b540f8, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xb004bc29, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x36b540f8, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0093.194] GetProcessHeap () returned 0x580000 [0093.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.195] GetProcessHeap () returned 0x580000 [0093.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.195] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x37eb3642, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xe4deabeb, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe4deabeb, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.197] GetProcessHeap () returned 0x580000 [0093.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4deabeb, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa90b6d32, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa90b6d32, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0093.199] GetProcessHeap () returned 0x580000 [0093.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.199] GetProcessHeap () returned 0x580000 [0093.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.200] GetProcessHeap () returned 0x580000 [0093.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.200] GetProcessHeap () returned 0x580000 [0093.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3979638c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xb00f9315, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3a630d34, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0093.205] GetProcessHeap () returned 0x580000 [0093.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39a1ec32, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xb00fa945, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x39a1ec32, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0093.205] GetProcessHeap () returned 0x580000 [0093.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.205] GetProcessHeap () returned 0x580000 [0093.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3a630d34, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xe56b56ac, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe56b56ac, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0093.207] GetProcessHeap () returned 0x580000 [0093.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.207] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Services.Store.Engagement_10.0.1706.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe56b56ac, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa91031f7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa91031f7, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0093.208] GetProcessHeap () returned 0x580000 [0093.208] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.208] GetProcessHeap () returned 0x580000 [0093.208] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.209] GetProcessHeap () returned 0x580000 [0093.209] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.249] GetProcessHeap () returned 0x580000 [0093.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.249] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbff4e2d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdba3c24b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba3c24b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0093.252] GetProcessHeap () returned 0x580000 [0093.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdba3c24b, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdba3c24b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba3c24b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.252] GetProcessHeap () returned 0x580000 [0093.252] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.252] GetProcessHeap () returned 0x580000 [0093.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\SkypeApp\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0b39f5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb020b681, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc0b39f5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0093.359] GetProcessHeap () returned 0x580000 [0093.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\SkypeApp\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0b39f5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb02ab869, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc1725bd, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0093.361] GetProcessHeap () returned 0x580000 [0093.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-100_kzf8qxf38zg5c\\SkypeApp\\Assets\\Images\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc0d9c4e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb02ac9ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc0d9c4e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0a0 [0093.361] GetProcessHeap () returned 0x580000 [0093.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.361] GetProcessHeap () returned 0x580000 [0093.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.362] GetProcessHeap () returned 0x580000 [0093.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.362] GetProcessHeap () returned 0x580000 [0093.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.362] GetProcessHeap () returned 0x580000 [0093.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.363] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73778cb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdba15ff2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba15ff2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0093.364] GetProcessHeap () returned 0x580000 [0093.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73778cb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0335567, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x73778cb, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0093.365] GetProcessHeap () returned 0x580000 [0093.365] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.365] GetProcessHeap () returned 0x580000 [0093.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_neutral_~_kzf8qxf38zg5c\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdba15ff2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdba15ff2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba15ff2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0093.365] GetProcessHeap () returned 0x580000 [0093.365] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.365] GetProcessHeap () returned 0x580000 [0093.365] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.366] GetProcessHeap () returned 0x580000 [0093.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7410239, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdba15ff2, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdba15ff2, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0093.368] GetProcessHeap () returned 0x580000 [0093.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c6e7, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb03fc1b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x745c6e7, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0093.368] GetProcessHeap () returned 0x580000 [0093.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.368] GetProcessHeap () returned 0x580000 [0093.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdba15ff2, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x888bff4e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x888bff4e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0093.369] GetProcessHeap () returned 0x580000 [0093.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.369] GetProcessHeap () returned 0x580000 [0093.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd5c51, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb03fd343, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x887a4f1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0093.369] GetProcessHeap () returned 0x580000 [0093.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.370] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd5c51, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb045bfbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8854298, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0093.372] GetProcessHeap () returned 0x580000 [0093.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.372] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Assets\\Audio\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd5c51, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb04fda55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x81ebd4a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0093.374] GetProcessHeap () returned 0x580000 [0093.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.374] GetProcessHeap () returned 0x580000 [0093.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Assets\\Images\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x825e45b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb05006d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x83b598c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0093.376] GetProcessHeap () returned 0x580000 [0093.376] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.377] GetProcessHeap () returned 0x580000 [0093.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Assets\\Text\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8854298, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0501269, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8854298, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0093.377] GetProcessHeap () returned 0x580000 [0093.377] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.377] GetProcessHeap () returned 0x580000 [0093.377] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.378] GetProcessHeap () returned 0x580000 [0093.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff54c0 [0093.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Designs\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x887a4f1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb05022d8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab6490e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0093.379] GetProcessHeap () returned 0x580000 [0093.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Designs\\Emoticons\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x887a4f1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb05031a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9229e15, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.379] GetProcessHeap () returned 0x580000 [0093.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0093.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Designs\\Emoticons\\large\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x887a4f1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb05f6ee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9229e15, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0093.383] GetProcessHeap () returned 0x580000 [0093.383] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0093.383] GetProcessHeap () returned 0x580000 [0093.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0093.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Designs\\Emoticons\\small\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9229e15, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb067e10d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x97fd903, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0093.387] GetProcessHeap () returned 0x580000 [0093.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0093.387] GetProcessHeap () returned 0x580000 [0093.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.387] GetProcessHeap () returned 0x580000 [0093.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200054c8 [0093.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Designs\\Flags\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9823b5c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb067f17b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa4790d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0093.388] GetProcessHeap () returned 0x580000 [0093.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x200154d0 [0093.388] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Designs\\Flags\\large\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9823b5c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa4790d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0093.396] GetProcessHeap () returned 0x580000 [0093.396] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200154d0 | out: hHeap=0x580000) returned 1 [0093.396] GetProcessHeap () returned 0x580000 [0093.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\SkypeApp\\Designs\\Flags\\small\\*", lpFindFileData=0x1fb9eaf0 | out: lpFindFileData=0x1fb9eaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4790d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb08d0d29, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab6490e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0093.510] GetProcessHeap () returned 0x580000 [0093.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.510] GetProcessHeap () returned 0x580000 [0093.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x200054c8 | out: hHeap=0x580000) returned 1 [0093.511] GetProcessHeap () returned 0x580000 [0093.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff54c0 | out: hHeap=0x580000) returned 1 [0093.512] GetProcessHeap () returned 0x580000 [0093.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.513] GetProcessHeap () returned 0x580000 [0093.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\\_Resources\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7482940, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb03fb4c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7482940, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0093.513] GetProcessHeap () returned 0x580000 [0093.513] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.513] GetProcessHeap () returned 0x580000 [0093.513] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.514] GetProcessHeap () returned 0x580000 [0093.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x137b8f21, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdfec7dad, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfec7dad, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0093.516] GetProcessHeap () returned 0x580000 [0093.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x138053d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0975177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x138053d9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.516] GetProcessHeap () returned 0x580000 [0093.516] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.516] GetProcessHeap () returned 0x580000 [0093.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x138053d9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb09dc5d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1385188b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a420 [0093.518] GetProcessHeap () returned 0x580000 [0093.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.518] GetProcessHeap () returned 0x580000 [0093.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdfec7dad, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xdfec7dad, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfec7dad, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0093.519] GetProcessHeap () returned 0x580000 [0093.519] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.520] GetProcessHeap () returned 0x580000 [0093.520] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.520] GetProcessHeap () returned 0x580000 [0093.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1374681a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xdfea1b47, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xdfea1b47, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0093.522] GetProcessHeap () returned 0x580000 [0093.522] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1374681a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0a25f5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1374681a, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0093.523] GetProcessHeap () returned 0x580000 [0093.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.523] GetProcessHeap () returned 0x580000 [0093.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.StorePurchaseApp_1.0.454.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xdfea1b47, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb0a26390, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdfea1b47, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.523] GetProcessHeap () returned 0x580000 [0093.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.523] GetProcessHeap () returned 0x580000 [0093.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.524] GetProcessHeap () returned 0x580000 [0093.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eace405, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0a85441, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b9575e3, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0093.528] GetProcessHeap () returned 0x580000 [0093.528] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eace405, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0a862ba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9eace405, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0093.529] GetProcessHeap () returned 0x580000 [0093.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.529] GetProcessHeap () returned 0x580000 [0093.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5b9575e3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe5ee7834, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe5ee7834, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0093.529] GetProcessHeap () returned 0x580000 [0093.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe5ee7834, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe5ee7834, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe5ee7834, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0093.531] GetProcessHeap () returned 0x580000 [0093.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.531] GetProcessHeap () returned 0x580000 [0093.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.532] GetProcessHeap () returned 0x580000 [0093.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.532] GetProcessHeap () returned 0x580000 [0093.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9eb8d19b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0ace717, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5b6ced31, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0093.534] GetProcessHeap () returned 0x580000 [0093.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ebb321a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0acfda8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9ebb321a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0093.535] GetProcessHeap () returned 0x580000 [0093.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.535] GetProcessHeap () returned 0x580000 [0093.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.535] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5b6ced31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe665ae03, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe665ae03, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0093.535] GetProcessHeap () returned 0x580000 [0093.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe665ae03, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe665ae03, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe665ae03, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0093.536] GetProcessHeap () returned 0x580000 [0093.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.536] GetProcessHeap () returned 0x580000 [0093.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.537] GetProcessHeap () returned 0x580000 [0093.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.538] GetProcessHeap () returned 0x580000 [0093.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc9b2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb13a1d82, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb13a1d82, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.540] GetProcessHeap () returned 0x580000 [0093.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1348e69, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0b1b1e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1348e69, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0093.540] GetProcessHeap () returned 0x580000 [0093.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.540] GetProcessHeap () returned 0x580000 [0093.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb13a1d82, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xec3ce583, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec3ce583, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.541] GetProcessHeap () returned 0x580000 [0093.541] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec3ce583, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec3ce583, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec3ce583, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0093.543] GetProcessHeap () returned 0x580000 [0093.543] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.543] GetProcessHeap () returned 0x580000 [0093.543] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.544] GetProcessHeap () returned 0x580000 [0093.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.545] GetProcessHeap () returned 0x580000 [0093.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1538d09, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0d397aa, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb0d397aa, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0093.547] GetProcessHeap () returned 0x580000 [0093.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x155ef67, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0bda2d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x155ef67, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0093.547] GetProcessHeap () returned 0x580000 [0093.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.547] GetProcessHeap () returned 0x580000 [0093.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb0d397aa, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xec1de6d7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec1de6d7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0093.548] GetProcessHeap () returned 0x580000 [0093.548] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.VCLibs.140.00_14.0.24123.0_x86__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec1de6d7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xec1de6d7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec1de6d7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.549] GetProcessHeap () returned 0x580000 [0093.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.549] GetProcessHeap () returned 0x580000 [0093.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.550] GetProcessHeap () returned 0x580000 [0093.550] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.551] GetProcessHeap () returned 0x580000 [0093.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7e7ba3c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe09a894e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe09a894e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0093.674] GetProcessHeap () returned 0x580000 [0093.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7e7ba3c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0c2f555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa7e7ba3c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a020 [0093.687] GetProcessHeap () returned 0x580000 [0093.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.688] GetProcessHeap () returned 0x580000 [0093.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe098276e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb0c2fbb1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe098276e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0093.690] GetProcessHeap () returned 0x580000 [0093.690] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.690] GetProcessHeap () returned 0x580000 [0093.690] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.691] GetProcessHeap () returned 0x580000 [0093.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8150701, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe09a894e, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe09a894e, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a1a0 [0093.695] GetProcessHeap () returned 0x580000 [0093.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa819cbaf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0d1f064, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa819cbaf, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0093.695] GetProcessHeap () returned 0x580000 [0093.695] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.695] GetProcessHeap () returned 0x580000 [0093.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\images\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa819cbaf, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0d716f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa820f2c9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029f20 [0093.698] GetProcessHeap () returned 0x580000 [0093.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.699] GetProcessHeap () returned 0x580000 [0093.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\js\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa820f2c9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0d721ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa820f2c9, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0093.699] GetProcessHeap () returned 0x580000 [0093.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.699] GetProcessHeap () returned 0x580000 [0093.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe09a894e, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xc770c60a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc770c60a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0093.699] GetProcessHeap () returned 0x580000 [0093.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.700] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\Autogen\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc770c60a, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc770c60a, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc770c60a, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0093.701] GetProcessHeap () returned 0x580000 [0093.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.701] GetProcessHeap () returned 0x580000 [0093.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.701] GetProcessHeap () returned 0x580000 [0093.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.702] GetProcessHeap () returned 0x580000 [0093.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.702] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe563d29, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0e615f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x716c6041, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0093.704] GetProcessHeap () returned 0x580000 [0093.704] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe589f8c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xb0f30e8c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbe5b019c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0093.706] GetProcessHeap () returned 0x580000 [0093.706] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.706] GetProcessHeap () returned 0x580000 [0093.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.706] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-200_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x716c6041, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xb0f31d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x716c6041, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0093.707] GetProcessHeap () returned 0x580000 [0093.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.707] GetProcessHeap () returned 0x580000 [0093.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.707] GetProcessHeap () returned 0x580000 [0093.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.708] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d169f9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe8ca3fa7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8ca3fa7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0093.709] GetProcessHeap () returned 0x580000 [0093.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.709] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86d3cc52, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0f84b23, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86deed4d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0093.711] GetProcessHeap () returned 0x580000 [0093.711] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.711] GetProcessHeap () returned 0x580000 [0093.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.711] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\Lumia.ViewerPlugin\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86deed4d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb0f85922, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86deed4d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0093.711] GetProcessHeap () returned 0x580000 [0093.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\Lumia.ViewerPlugin\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86deed4d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb104434a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86e3b22e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a060 [0093.714] GetProcessHeap () returned 0x580000 [0093.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.714] GetProcessHeap () returned 0x580000 [0093.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.715] GetProcessHeap () returned 0x580000 [0093.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe8ca3fa7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe8ca3fa7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8ca3fa7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.716] GetProcessHeap () returned 0x580000 [0093.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.716] GetProcessHeap () returned 0x580000 [0093.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.717] GetProcessHeap () returned 0x580000 [0093.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86e61487, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe8ca3fa7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8ca3fa7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0093.720] GetProcessHeap () returned 0x580000 [0093.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86ead93a, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb10a896e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86ef9df1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fe0 [0093.722] GetProcessHeap () returned 0x580000 [0093.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.722] GetProcessHeap () returned 0x580000 [0093.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.722] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\\Lumia.ViewerPlugin\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86ef9df1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb10a9b5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86ef9df1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.722] GetProcessHeap () returned 0x580000 [0093.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\\Lumia.ViewerPlugin\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86ef9df1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1139167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86f5a04b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0093.725] GetProcessHeap () returned 0x580000 [0093.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.725] GetProcessHeap () returned 0x580000 [0093.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.726] GetProcessHeap () returned 0x580000 [0093.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe8ca3fa7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe8ca3fa7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8ca3fa7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0093.726] GetProcessHeap () returned 0x580000 [0093.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0093.726] GetProcessHeap () returned 0x580000 [0093.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0093.727] GetProcessHeap () returned 0x580000 [0093.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0093.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845121d2, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe8ca3fa7, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8ca3fa7, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4e0 [0093.727] GetProcessHeap () returned 0x580000 [0093.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0093.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\AppCS\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x846696fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb113db64, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x846696fa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0093.728] GetProcessHeap () returned 0x580000 [0093.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0093.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\AppCS\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x846696fa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb113ea79, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x846696fa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0093.729] GetProcessHeap () returned 0x580000 [0093.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0093.729] GetProcessHeap () returned 0x580000 [0093.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.002] GetProcessHeap () returned 0x580000 [0094.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845848da, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb113f7c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x845848da, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0094.003] GetProcessHeap () returned 0x580000 [0094.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.003] GetProcessHeap () returned 0x580000 [0094.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8468f958, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb120ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x85423bf4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d20 [0094.005] GetProcessHeap () returned 0x580000 [0094.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.005] GetProcessHeap () returned 0x580000 [0094.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Bing.Immersive\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x854700ab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb120f88d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x854700ab, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a320 [0094.006] GetProcessHeap () returned 0x580000 [0094.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Bing.Immersive\\Shaders\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x854700ab, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1210963, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8549630e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0094.007] GetProcessHeap () returned 0x580000 [0094.007] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.007] GetProcessHeap () returned 0x580000 [0094.007] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.007] GetProcessHeap () returned 0x580000 [0094.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.AppTk.NativeDirect3d.UAP\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8565ff4b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1211054, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8565ff4b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0094.007] GetProcessHeap () returned 0x580000 [0094.007] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.007] GetProcessHeap () returned 0x580000 [0094.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.VideoTk\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85744d6c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1306fa7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x857b747c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0094.009] GetProcessHeap () returned 0x580000 [0094.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.009] GetProcessHeap () returned 0x580000 [0094.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857b747c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1308123, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x858571c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0094.011] GetProcessHeap () returned 0x580000 [0094.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.011] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x857b747c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136b57a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x85803933, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0094.013] GetProcessHeap () returned 0x580000 [0094.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.013] GetProcessHeap () returned 0x580000 [0094.013] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\CinemagraphDelegate\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85830f47, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136be4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x85830f47, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a3e0 [0094.014] GetProcessHeap () returned 0x580000 [0094.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.014] GetProcessHeap () returned 0x580000 [0094.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\Common\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85830f47, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136cb5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x85830f47, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0094.014] GetProcessHeap () returned 0x580000 [0094.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.014] GetProcessHeap () returned 0x580000 [0094.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\CompositeSurface\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x858571c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136d809, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x858571c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ea0 [0094.015] GetProcessHeap () returned 0x580000 [0094.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.015] GetProcessHeap () returned 0x580000 [0094.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\JpegSurface\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x858571c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136e08a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x858571c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e60 [0094.015] GetProcessHeap () returned 0x580000 [0094.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.015] GetProcessHeap () returned 0x580000 [0094.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\ReliveSurfaces\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x858571c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136e5d8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8587d423, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029da0 [0094.015] GetProcessHeap () returned 0x580000 [0094.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff4d98 [0094.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\ReliveSurfaces\\Preview\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x858571c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136f0e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x858571c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029fa0 [0094.015] GetProcessHeap () returned 0x580000 [0094.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff4d98 | out: hHeap=0x580000) returned 1 [0094.015] GetProcessHeap () returned 0x580000 [0094.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff4d98 [0094.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\ReliveSurfaces\\Sequence\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x858571c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb136fa8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x858571c5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0094.016] GetProcessHeap () returned 0x580000 [0094.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff4d98 | out: hHeap=0x580000) returned 1 [0094.016] GetProcessHeap () returned 0x580000 [0094.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff4d98 [0094.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\ReliveSurfaces\\Video\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8587d423, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb13701c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8587d423, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a160 [0094.016] GetProcessHeap () returned 0x580000 [0094.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff4d98 | out: hHeap=0x580000) returned 1 [0094.016] GetProcessHeap () returned 0x580000 [0094.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff4d98 [0094.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\Lumia.ViewerPlugin\\ReliveSurfaces\\ZoomPan\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8587d423, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb13708b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8587d423, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a2a0 [0094.017] GetProcessHeap () returned 0x580000 [0094.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff4d98 | out: hHeap=0x580000) returned 1 [0094.017] GetProcessHeap () returned 0x580000 [0094.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.018] GetProcessHeap () returned 0x580000 [0094.018] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.018] GetProcessHeap () returned 0x580000 [0094.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe8ca3fa7, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xec4ff828, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xec4ff828, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a460 [0094.018] GetProcessHeap () returned 0x580000 [0094.018] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.018] GetProcessHeap () returned 0x580000 [0094.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\PhotosApp\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8644bef6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1371afa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86472154, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a220 [0094.018] GetProcessHeap () returned 0x580000 [0094.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffe4d90 [0094.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\PhotosApp\\Assets\\*", lpFindFileData=0x1fb9f010 | out: lpFindFileData=0x1fb9f010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86472154, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1372638, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86472154, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a360 [0094.019] GetProcessHeap () returned 0x580000 [0094.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1fff4d98 [0094.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\\PhotosApp\\Assets\\ThirdPartyNotices\\*", lpFindFileData=0x1fb9ed80 | out: lpFindFileData=0x1fb9ed80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86472154, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb13730f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x86472154, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0094.019] GetProcessHeap () returned 0x580000 [0094.019] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1fff4d98 | out: hHeap=0x580000) returned 1 [0094.019] GetProcessHeap () returned 0x580000 [0094.019] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffe4d90 | out: hHeap=0x580000) returned 1 [0094.020] GetProcessHeap () returned 0x580000 [0094.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.020] GetProcessHeap () returned 0x580000 [0094.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0094.021] GetProcessHeap () returned 0x580000 [0094.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0094.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84322329, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xe8c7dd6a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8c7dd6a, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0094.023] GetProcessHeap () returned 0x580000 [0094.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x84322329, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb13da82d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x84322329, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029de0 [0094.023] GetProcessHeap () returned 0x580000 [0094.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.023] GetProcessHeap () returned 0x580000 [0094.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.023] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_2016.511.9510.0_neutral_~_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xe8c7dd6a, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xe8c7dd6a, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xe8c7dd6a, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0094.023] GetProcessHeap () returned 0x580000 [0094.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.023] GetProcessHeap () returned 0x580000 [0094.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0094.024] GetProcessHeap () returned 0x580000 [0094.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0094.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x485b9d47, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xebb94597, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xebb94597, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a120 [0094.025] GetProcessHeap () returned 0x580000 [0094.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.026] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x485b9d47, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1437fbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4878db60, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a260 [0094.029] GetProcessHeap () returned 0x580000 [0094.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.029] GetProcessHeap () returned 0x580000 [0094.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebb94597, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xebb94597, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xebb94597, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029d60 [0094.029] GetProcessHeap () returned 0x580000 [0094.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.029] GetProcessHeap () returned 0x580000 [0094.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 [0094.030] GetProcessHeap () returned 0x580000 [0094.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffc40a8 [0094.030] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\*", lpFindFileData=0x1fb9f530 | out: lpFindFileData=0x1fb9f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x479ad420, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xebb94597, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xebb94597, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a4a0 [0094.031] GetProcessHeap () returned 0x580000 [0094.031] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.031] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\AppxMetadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47a4c028, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb143a0a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47a4c028, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029ee0 [0094.032] GetProcessHeap () returned 0x580000 [0094.032] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.032] GetProcessHeap () returned 0x580000 [0094.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.032] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\Assets\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47a7225c, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb1502df3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x48164a4b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x20029e20 [0094.040] GetProcessHeap () returned 0x580000 [0094.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.040] GetProcessHeap () returned 0x580000 [0094.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ffd40b0 [0094.040] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.WindowsAlarms_10.1702.333.0_x64__8wekyb3d8bbwe\\microsoft.system.package.metadata\\*", lpFindFileData=0x1fb9f2a0 | out: lpFindFileData=0x1fb9f2a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebb94597, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x85720f04, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x85720f04, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2002a0e0 [0094.040] GetProcessHeap () returned 0x580000 [0094.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffd40b0 | out: hHeap=0x580000) returned 1 [0094.040] GetProcessHeap () returned 0x580000 [0094.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x1ffc40a8 | out: hHeap=0x580000) returned 1 Thread: id = 19 os_tid = 0xc30 [0064.800] GetCurrentThreadId () returned 0xc30 [0064.809] GetProcessHeap () returned 0x580000 [0064.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x629f98 [0064.814] GetProcessHeap () returned 0x580000 [0064.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x639fa0 [0064.819] GetProcessHeap () returned 0x580000 [0064.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x5c3018 [0064.823] GetProcessHeap () returned 0x580000 [0064.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x110102) returned 0x1fe22020 [0064.831] GetProcessHeap () returned 0x580000 [0064.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x5a85c0 [0064.835] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0064.835] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0064.835] Wow64DisableWow64FsRedirection (in: OldValue=0x1fcdff68 | out: OldValue=0x1fcdff68*=0x0) returned 1 [0064.836] GetProcessHeap () returned 0x580000 [0064.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a85c0 | out: hHeap=0x580000) returned 1 [0065.045] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.054] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.063] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.462] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.855] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.864] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.873] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.883] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.283] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.444] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.453] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.462] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.520] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.737] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.747] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.755] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.764] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.772] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.148] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.157] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.510] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.519] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.528] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.536] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.544] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.553] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.749] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.758] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.767] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.776] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.785] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.211] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.221] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.356] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.560] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.569] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.578] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.792] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.801] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.810] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.819] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.828] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.103] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.405] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.415] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.424] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.668] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.839] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.848] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.856] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.865] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.213] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.221] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.230] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.238] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.517] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.526] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.535] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.544] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.553] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.880] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.889] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.898] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.046] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.055] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.064] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.073] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.083] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.404] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.541] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.550] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.559] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.568] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.858] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.087] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.098] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.107] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.116] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.467] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.476] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.518] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.527] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.535] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.544] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.849] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.857] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.865] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.874] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.883] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.970] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.148] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.157] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.182] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.412] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.421] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.431] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.440] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.449] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.694] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.704] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.713] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.722] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.731] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.958] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.967] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.976] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.155] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.334] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.343] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.352] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.361] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.370] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.537] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.547] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.556] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.566] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.717] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.052] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.061] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.070] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.314] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.323] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.331] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.340] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.550] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.558] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.796] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.806] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.236] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.245] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.253] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.262] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.271] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.581] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.651] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.660] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.669] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.981] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.990] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.999] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.014] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.473] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.481] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.490] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.499] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.508] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.801] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.810] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.819] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.827] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.838] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.200] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.209] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.218] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.227] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.625] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.880] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.889] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.898] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.161] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.162] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.163] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.164] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.165] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.166] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.167] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.168] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.169] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.170] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.171] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.172] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.173] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.174] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.175] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.176] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.177] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.178] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.179] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.179] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.179] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0082.676] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfed8 | out: lpNewFilePointer=0x0) returned 1 [0082.677] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfed8 | out: lpNewFilePointer=0x0) returned 1 [0082.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x4d8 [0082.677] ReadFile (in: hFile=0x4d4, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0082.806] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0082.825] ReadFile (in: hFile=0x4d4, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0xedf00, lpOverlapped=0x0) returned 1 [0082.837] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0xedf10, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0xedf10, lpOverlapped=0x0) returned 1 [0083.060] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0xf2, lpOverlapped=0x0) returned 1 [0083.060] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfc38 | out: lpNewFilePointer=0x0) returned 1 [0083.060] SetFilePointerEx (in: hFile=0x4d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfc38 | out: lpNewFilePointer=0x0) returned 1 [0083.060] WriteFile (in: hFile=0x4d4, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0083.065] WriteFile (in: hFile=0x4d4, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0xedefe, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0xedefe, lpOverlapped=0x0) returned 1 [0083.068] FlushFileBuffers (hFile=0x4d4) returned 1 [0083.076] FlushFileBuffers (hFile=0x4d8) returned 1 [0083.080] CloseHandle (hObject=0x4d4) returned 1 [0083.080] CloseHandle (hObject=0x4d8) returned 1 [0083.395] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde")) returned 1 [0083.412] ResetEvent (hEvent=0x344) returned 1 [0083.412] SetEvent (hEvent=0x32c) returned 1 [0083.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0083.413] GetFileSizeEx (in: hFile=0x4d8, lpFileSize=0x1fcdff10 | out: lpFileSize=0x1fcdff10*=11493376) returned 1 [0083.413] CloseHandle (hObject=0x4d8) returned 1 [0083.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde")) returned 0x220 [0083.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde")) returned 0x220 [0083.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0083.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d8 [0083.413] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfed8 | out: lpNewFilePointer=0x0) returned 1 [0083.413] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfed8 | out: lpNewFilePointer=0x0) returned 1 [0083.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x4cc [0083.413] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0083.684] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0083.705] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0083.846] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0084.012] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0084.057] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0084.211] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0084.245] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0084.573] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0084.594] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0085.011] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0085.144] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0085.164] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0085.185] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0085.408] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0085.429] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0085.583] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0085.606] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0085.914] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x110100, lpOverlapped=0x0) returned 1 [0085.934] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x110100, lpOverlapped=0x0) returned 1 [0086.074] ReadFile (in: hFile=0x4d8, lpBuffer=0x1fe22020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fcdfeec, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesRead=0x1fcdfeec*=0x55600, lpOverlapped=0x0) returned 1 [0086.079] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x55610, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0x55610, lpOverlapped=0x0) returned 1 [0086.084] WriteFile (in: hFile=0x4cc, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1fcdfec4, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfec4*=0xf2, lpOverlapped=0x0) returned 1 [0086.085] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.085] SetFilePointerEx (in: hFile=0x4d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fcdfc38 | out: lpNewFilePointer=0x0) returned 1 [0086.085] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.098] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.392] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.405] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.418] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.742] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.755] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.767] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.930] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.942] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.952] WriteFile (in: hFile=0x4d8, lpBuffer=0x1fe22020*, nNumberOfBytesToWrite=0x555ec, lpNumberOfBytesWritten=0x1fcdfc44, lpOverlapped=0x0 | out: lpBuffer=0x1fe22020*, lpNumberOfBytesWritten=0x1fcdfc44*=0x555ec, lpOverlapped=0x0) returned 1 [0086.953] FlushFileBuffers (hFile=0x4d8) returned 1 [0087.626] FlushFileBuffers (hFile=0x4cc) returned 1 [0088.786] CloseHandle (hObject=0x4d8) returned 1 [0089.709] CloseHandle (hObject=0x4cc) returned 1 [0090.818] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwztool.accde")) returned 1 [0090.835] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) Thread: id = 20 os_tid = 0xf4c [0064.845] GetCurrentThreadId () returned 0xf4c [0064.855] GetProcessHeap () returned 0x580000 [0064.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff40048 [0064.860] GetProcessHeap () returned 0x580000 [0064.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10000) returned 0x1ff50050 [0064.865] GetProcessHeap () returned 0x580000 [0064.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x28) returned 0x5c3048 [0064.869] GetProcessHeap () returned 0x580000 [0064.874] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x110102) returned 0x20042020 [0064.876] GetProcessHeap () returned 0x580000 [0064.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50) returned 0x5a85c0 [0064.881] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0064.881] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0064.881] Wow64DisableWow64FsRedirection (in: OldValue=0x1fe1ff68 | out: OldValue=0x1fe1ff68*=0x0) returned 1 [0064.881] GetProcessHeap () returned 0x580000 [0064.881] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5a85c0 | out: hHeap=0x580000) returned 1 [0065.427] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.443] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.453] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0065.892] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.238] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.247] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.256] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.265] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.274] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.526] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.537] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.547] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.557] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.781] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.790] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.799] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.807] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0066.816] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.209] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.470] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.479] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.487] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.497] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.506] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.704] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.713] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.722] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.731] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.740] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.972] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.982] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0067.991] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.002] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.230] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.320] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.329] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.338] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.347] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.587] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.752] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.761] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.770] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.778] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0068.787] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.067] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.076] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.085] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.094] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.433] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.624] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.633] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.641] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.650] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.659] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.870] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.878] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.887] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.895] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.904] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0069.912] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.247] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.255] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.264] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.272] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.563] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.572] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.581] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0070.907] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.006] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.015] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.024] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.033] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.042] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.363] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.377] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.394] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.582] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.831] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.840] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0071.849] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.428] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.436] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.445] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.454] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.462] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.659] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.669] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.715] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.891] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.927] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.936] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.944] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.953] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0072.961] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.210] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.219] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.227] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.236] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.244] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.459] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.468] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.477] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.486] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.495] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.741] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.750] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.759] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.768] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0073.777] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.118] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.146] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.375] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.413] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.575] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.689] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.698] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0074.708] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.079] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.281] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.290] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.299] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.308] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.505] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.514] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.523] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.532] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0075.541] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.027] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.036] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.045] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.053] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.061] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.276] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.306] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.314] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.325] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.334] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.845] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.854] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.862] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.871] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0076.880] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.442] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.451] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.460] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.468] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.760] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.769] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.778] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.787] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0077.797] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.116] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.145] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.154] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.597] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.606] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.616] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0078.907] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.123] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.124] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.124] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.124] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.125] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.126] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.127] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.128] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.129] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.130] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.131] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.132] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.133] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.134] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.135] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.136] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.137] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.138] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.139] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.140] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.141] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0079.142] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0081.977] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fed8 | out: lpNewFilePointer=0x0) returned 1 [0081.977] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fed8 | out: lpNewFilePointer=0x0) returned 1 [0081.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x6c8 [0081.979] ReadFile (in: hFile=0x6c4, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x7c000, lpOverlapped=0x0) returned 1 [0082.180] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x7c010, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x7c010, lpOverlapped=0x0) returned 1 [0082.188] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0xf2, lpOverlapped=0x0) returned 1 [0082.188] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fc38 | out: lpNewFilePointer=0x0) returned 1 [0082.188] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fc38 | out: lpNewFilePointer=0x0) returned 1 [0082.188] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x7c000, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x7c000, lpOverlapped=0x0) returned 1 [0082.190] FlushFileBuffers (hFile=0x6c4) returned 1 [0082.929] FlushFileBuffers (hFile=0x6c8) returned 1 [0082.932] CloseHandle (hObject=0x6c4) returned 1 [0082.932] CloseHandle (hObject=0x6c8) returned 1 [0082.941] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb")) returned 1 [0082.945] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0082.947] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x1fe1ff10 | out: lpFileSize=0x1fe1ff10*=9277440) returned 1 [0082.947] CloseHandle (hObject=0x6c8) returned 1 [0082.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde")) returned 0x220 [0082.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde")) returned 0x220 [0082.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0082.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0082.947] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fed8 | out: lpNewFilePointer=0x0) returned 1 [0082.947] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fed8 | out: lpNewFilePointer=0x0) returned 1 [0082.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2275].[checkcheck07@qq.com].adame"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x6c4 [0082.947] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0083.249] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0083.268] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0083.503] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0083.523] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0083.774] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0083.947] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0083.982] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0084.143] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0084.164] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0084.433] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0084.455] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0084.653] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0084.675] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0085.109] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x110100, lpOverlapped=0x0) returned 1 [0085.252] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x110100, lpOverlapped=0x0) returned 1 [0085.274] ReadFile (in: hFile=0x6c8, lpBuffer=0x20042020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x1fe1feec, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesRead=0x1fe1feec*=0x58800, lpOverlapped=0x0) returned 1 [0085.278] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x58810, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0x58810, lpOverlapped=0x0) returned 1 [0085.284] WriteFile (in: hFile=0x6c4, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x1fe1fec4, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fec4*=0xf2, lpOverlapped=0x0) returned 1 [0085.284] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.284] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x1fe1fc38 | out: lpNewFilePointer=0x0) returned 1 [0085.284] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0085.504] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0085.517] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0085.692] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0085.709] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0085.721] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0085.994] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.007] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x110102, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x110102, lpOverlapped=0x0) returned 1 [0086.019] WriteFile (in: hFile=0x6c8, lpBuffer=0x20042020*, nNumberOfBytesToWrite=0x587f0, lpNumberOfBytesWritten=0x1fe1fc44, lpOverlapped=0x0 | out: lpBuffer=0x20042020*, lpNumberOfBytesWritten=0x1fe1fc44*=0x587f0, lpOverlapped=0x0) returned 1 [0086.020] FlushFileBuffers (hFile=0x6c8) returned 1 [0087.081] FlushFileBuffers (hFile=0x6c4) returned 1 [0087.260] CloseHandle (hObject=0x6c8) returned 1 [0088.432] CloseHandle (hObject=0x6c4) returned 1 [0089.446] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde")) returned 1 [0089.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0089.458] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1fe1ff10 | out: lpFileSize=0x1fe1ff10*=88064) returned 1 [0089.458] CloseHandle (hObject=0x51c) returned 1 [0089.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0089.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingfinance_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0089.459] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1fe1ff10 | out: lpFileSize=0x1fe1ff10*=110592) returned 1 [0089.459] CloseHandle (hObject=0x51c) returned 1 [0089.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0089.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingnews_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.460] ResetEvent (hEvent=0x344) returned 1 [0089.460] SetEvent (hEvent=0x32c) returned 1 [0089.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0089.460] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x1fe1ff10 | out: lpFileSize=0x1fe1ff10*=146432) returned 1 [0089.460] CloseHandle (hObject=0x51c) returned 1 [0089.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0089.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingsports_4.6.169.0_x86__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.460] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) returned 0x0 [0089.736] ResetEvent (hEvent=0x344) returned 1 [0089.736] SetEvent (hEvent=0x32c) returned 1 [0089.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c8 [0089.741] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x1fe1ff10 | out: lpFileSize=0x1fe1ff10*=147456) returned 1 [0089.741] CloseHandle (hObject=0x6c8) returned 1 [0089.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite")) returned 0x20 [0089.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite.id[B4197730-2275].[checkcheck07@qq.com].Adame" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite.id[b4197730-2275].[checkcheck07@qq.com].adame")) returned 0xffffffff [0089.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\WindowsApps\\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\\Configuration\\configuration.sqlite" (normalized: "c:\\program files\\windowsapps\\microsoft.bingweather_4.18.56.0_x64__8wekyb3d8bbwe\\configuration\\configuration.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.741] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0xffffffff) Thread: id = 27 os_tid = 0x8e8 [0080.288] GetCurrentThreadId () returned 0x8e8 Thread: id = 28 os_tid = 0xf64 [0082.926] GetCurrentThreadId () returned 0xf64 Thread: id = 29 os_tid = 0x4c8 [0083.220] GetCurrentThreadId () returned 0x4c8 Process: id = "3" image_name = "gasas.exe" filename = "c:\\users\\fd1hvy\\desktop\\gasas.exe" page_root = "0xf4bb000" os_pid = "0xd98" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x7fc" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x4c8 [0053.132] GetVersion () returned 0x23f00206 [0053.132] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0053.133] GetProcAddress (hModule=0x75e90000, lpProcName="IsTNT") returned 0x0 [0053.133] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2220000 [0053.152] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x2230000 [0053.153] VirtualAlloc (lpAddress=0x2230000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2230000 [0053.154] GetCurrentThreadId () returned 0x4c8 [0053.154] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\"" [0053.154] GetEnvironmentStringsW () returned 0x621458* [0053.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379 [0053.154] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x570) returned 0x22205a8 [0053.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x22205a8, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1379 [0053.154] FreeEnvironmentStringsW (penv=0x621458) returned 1 [0053.154] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x480) returned 0x2220b20 [0053.154] GetStartupInfoA (in: lpStartupInfo=0x19f8c4 | out: lpStartupInfo=0x19f8c4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0053.154] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0053.154] GetFileType (hFile=0x0) returned 0x0 [0053.154] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0053.154] GetFileType (hFile=0x0) returned 0x0 [0053.154] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0053.154] GetFileType (hFile=0x0) returned 0x0 [0053.154] SetHandleCount (uNumber=0x20) returned 0x20 [0053.155] GetACP () returned 0x4e4 [0053.155] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8ec | out: lpCPInfo=0x19f8ec) returned 1 [0053.155] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6610c528, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0053.156] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22205a8 | out: hHeap=0x2220000) returned 1 [0053.156] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x75e90000 [0053.156] GetProcAddress (hModule=0x75e90000, lpProcName="IsProcessorFeaturePresent") returned 0x75ea5960 [0053.156] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0053.156] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x800) returned 0x2220fa8 [0053.157] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0053.157] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x130 [0053.157] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0053.157] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x6610e6c8, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0053.157] GetVersion () returned 0x23f00206 [0053.157] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0053.159] GetUserDefaultLCID () returned 0x409 [0053.159] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0053.159] GetSystemMetrics (nIndex=5) returned 1 [0053.159] GetSystemMetrics (nIndex=6) returned 1 [0053.159] GetSystemMetrics (nIndex=11) returned 32 [0053.159] GetSystemMetrics (nIndex=12) returned 32 [0053.159] GetSystemMetrics (nIndex=34) returned 136 [0053.159] GetSystemMetrics (nIndex=35) returned 39 [0053.159] GetSystemMetrics (nIndex=0) returned 1440 [0053.160] GetSystemMetrics (nIndex=1) returned 900 [0053.160] GetSystemMetrics (nIndex=32) returned 8 [0053.160] GetSystemMetrics (nIndex=33) returned 8 [0053.160] GetSystemMetrics (nIndex=42) returned 0 [0053.160] GetStockObject (i=15) returned 0x88000b [0053.160] GetStockObject (i=7) returned 0xb00017 [0053.160] GetStockObject (i=6) returned 0xb00018 [0053.160] GetStockObject (i=8) returned 0xb00016 [0053.160] GetStockObject (i=4) returned 0x900011 [0053.160] GetStockObject (i=2) returned 0x900012 [0053.160] GetStockObject (i=0) returned 0x900010 [0053.160] GetStockObject (i=5) returned 0x900015 [0053.160] GetStockObject (i=13) returned 0x8a01c2 [0053.160] GetDC (hWnd=0x0) returned 0x60100ce [0053.160] GetTextExtentPointA (in: hdc=0x60100ce, lpString="0", c=1, lpsz=0x19f8e8 | out: lpsz=0x19f8e8) returned 1 [0053.162] GetDeviceCaps (hdc=0x60100ce, index=14) returned 1 [0053.162] GetDeviceCaps (hdc=0x60100ce, index=12) returned 32 [0053.162] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0053.162] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0053.162] GetDeviceCaps (hdc=0x60100ce, index=38) returned 32409 [0053.162] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0053.162] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x5f0000 [0053.163] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e7d0 | out: ppMalloc=0x6610e7d0*=0x75e4d000) returned 0x0 [0053.163] GetCurrentThreadId () returned 0x4c8 [0053.163] GetStartupInfoA (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0053.163] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x104) returned 0x5f05a8 [0053.163] GetCurrentThreadId () returned 0x4c8 [0053.163] GetCurrentThreadId () returned 0x4c8 [0053.163] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xec8) returned 0x5f06b8 [0053.163] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\"" [0053.163] lstrlenA (lpString="") returned 0 [0053.163] lstrcpyA (in: lpString1=0x19fea4, lpString2="" | out: lpString1="") returned="" [0053.164] SetErrorMode (uMode=0x8001) returned 0x0 [0053.164] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x19fb60, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0053.164] GetUserDefaultLCID () returned 0x409 [0053.164] lstrcpyA (in: lpString1=0x19f860, lpString2="*" | out: lpString1="*") returned="*" [0053.164] LoadStringA (in: hInstance=0x66000000, uID=0x7d1, lpBuffer=0x19fc64, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0053.164] GetSystemDefaultLCID () returned 0x409 [0053.164] GetUserDefaultLCID () returned 0x409 [0053.164] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x19fc6e, cchData=2 | out: lpLCData=".") returned 2 [0053.164] GetStockObject (i=13) returned 0x8a01c2 [0053.164] GetObjectA (in: h=0x8a01c2, c=60, pv=0x19fc34 | out: pv=0x19fc34) returned 60 [0053.164] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x19fc30, cchData=4 | out: lpLCData="ENU") returned 4 [0053.164] lstrcpyA (in: lpString1=0x19fc60, lpString2="EN" | out: lpString1="EN") returned="EN" [0053.164] lstrlenA (lpString="{xx}") returned 4 [0053.164] lstrlenA (lpString="VB98.CHM") returned 8 [0053.164] lstrcpyA (in: lpString1=0x6610eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0053.164] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x19fc30, cchData=4 | out: lpLCData="ENU") returned 4 [0053.164] lstrcpyA (in: lpString1=0x19fc60, lpString2="EN" | out: lpString1="EN") returned="EN" [0053.164] lstrlenA (lpString="{xx}") returned 4 [0053.164] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0053.164] lstrcpyA (in: lpString1=0x6610ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0053.164] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fd88, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0053.164] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x19fc84, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0053.164] lstrcpynA (in: lpString1=0x19fb68, lpString2="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL") returned="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" [0053.164] lstrlenA (lpString="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL") returned 32 [0053.164] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x21) returned 0x5f1588 [0053.164] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x21) returned 0x5f15b8 [0053.165] lstrcpyA (in: lpString1=0x5f1588, lpString2="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" | out: lpString1="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL") returned="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" [0053.165] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", cchSrc=-1, lpDestStr=0x19fb48, cchDest=260 | out: lpDestStr="C:\\USERS\\FD1HVY\\DESKTOP\\GASAS.EXE") returned 34 [0053.166] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x19fc4c, dwRevision=0x1 | out: pSecurityDescriptor=0x19fc4c) returned 1 [0053.166] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x19fc4c, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x19fc4c) returned 1 [0053.166] CreateSemaphoreA (lpSemaphoreAttributes=0x19fc60, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?USERS?FD1HVY?DESKTOP?GASAS.EXE") returned 0x144 [0053.166] GetLastError () returned 0x0 [0053.166] GetVersionExA (in: lpVersionInformation=0x19fbc4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19fbc4*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0053.166] OleInitialize (pvReserved=0x0) returned 0x0 [0053.279] OaBuildVersion () returned 0x321396 [0053.279] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x75bb0000 [0053.279] GetLastError () returned 0x0 [0053.279] GetProcAddress (hModule=0x75bb0000, lpProcName="OleLoadPictureEx") returned 0x75c1e5f0 [0053.279] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc151 [0053.279] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc07a [0053.280] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBFocusRT6", lpWndClass=0x19fc2c | out: lpWndClass=0x19fc2c) returned 0 [0053.280] RegisterClassA (lpWndClass=0x19fc2c) returned 0xc16f [0053.280] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBBubbleRT6", lpWndClass=0x19fc2c | out: lpWndClass=0x19fc2c) returned 0 [0053.280] RegisterClassA (lpWndClass=0x19fc2c) returned 0xc16d [0053.280] HeapCreate (flOptions=0x0, dwInitialSize=0x400, dwMaximumSize=0x0) returned 0x2b10000 [0053.280] GetUserDefaultLCID () returned 0x409 [0053.280] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3a4) returned 0x5f15e8 [0053.280] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3a4) returned 0x5f1998 [0053.280] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xd4) returned 0x5f1d48 [0053.280] GetSystemInfo (in: lpSystemInfo=0x19fbec | out: lpSystemInfo=0x19fbec*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0053.281] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x4b0000 [0053.281] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.281] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.281] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.281] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.281] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.281] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.282] VirtualProtect (in: lpAddress=0x4b0000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x19fc48 | out: lpflOldProtect=0x19fc48*=0x4) returned 1 [0053.283] GetCurrentProcess () returned 0xffffffff [0053.283] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x4b0000, dwSize=0x6000) returned 1 [0053.283] GlobalAddAtomA (lpString="VBDisabled") returned 0xc0b6 [0053.283] GetVersion () returned 0x23f00206 [0053.283] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x75bb0000 [0053.283] GetProcAddress (hModule=0x75bb0000, lpProcName="DispCallFunc") returned 0x75beb8f0 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="LoadTypeLibEx") returned 0x75bc63f0 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="UnRegisterTypeLib") returned 0x75c04910 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="CreateTypeLib2") returned 0x75be6040 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDateFromUdate") returned 0x75bd2cb0 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarUdateFromDate") returned 0x75bd2dc0 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="GetAltMonthNames") returned 0x75c1acd0 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNumFromParseNum") returned 0x75bd5920 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarParseNumFromStr") returned 0x75bc9490 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromR4") returned 0x75bc3090 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromR8") returned 0x75c1f1a0 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromDate") returned 0x75c1f000 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromI4") returned 0x75c1f0f0 [0053.284] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecFromCy") returned 0x75c1efc0 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="VarR4FromDec") returned 0x75c1f7b0 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x75bd2220 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="GetRecordInfoFromGuids") returned 0x75c1e250 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetRecordInfo") returned 0x75c1e9a0 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArraySetRecordInfo") returned 0x75bd3550 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayGetIID") returned 0x75c1e960 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArraySetIID") returned 0x75bd1a60 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayCopyData") returned 0x75bd3ee0 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x75bd36b0 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="SafeArrayCreateEx") returned 0x75bd35c0 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormat") returned 0x75be8000 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatDateTime") returned 0x75c21240 [0053.285] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatNumber") returned 0x75c21290 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatPercent") returned 0x75c21340 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFormatCurrency") returned 0x75c21180 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarWeekdayName") returned 0x75c21480 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMonthName") returned 0x75c213e0 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAdd") returned 0x75bed610 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAnd") returned 0x75be3200 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCat") returned 0x75be2f10 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDiv") returned 0x75c15800 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarEqv") returned 0x75c16160 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarIdiv") returned 0x75c161a0 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarImp") returned 0x75c16320 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMod") returned 0x75c16400 [0053.286] GetProcAddress (hModule=0x75bb0000, lpProcName="VarMul") returned 0x75bedb10 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarOr") returned 0x75c16610 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarPow") returned 0x75c15e40 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarSub") returned 0x75bee3e0 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarXor") returned 0x75c167b0 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarAbs") returned 0x75c14ca0 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarFix") returned 0x75c14f50 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarInt") returned 0x75c15100 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNeg") returned 0x75c152c0 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarNot") returned 0x75c16560 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarRound") returned 0x75c154f0 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCmp") returned 0x75bd60b0 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecAdd") returned 0x75beb090 [0053.287] GetProcAddress (hModule=0x75bb0000, lpProcName="VarDecCmp") returned 0x75beb870 [0053.288] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrCat") returned 0x75bd6fc0 [0053.288] GetProcAddress (hModule=0x75bb0000, lpProcName="VarCyMulI4") returned 0x75beaac0 [0053.288] GetProcAddress (hModule=0x75bb0000, lpProcName="VarBstrCmp") returned 0x75bd6590 [0053.288] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x77920000 [0053.288] GetProcAddress (hModule=0x77920000, lpProcName="CoCreateInstanceEx") returned 0x75d62d10 [0053.288] GetProcAddress (hModule=0x77920000, lpProcName="CLSIDFromProgIDEx") returned 0x75d55cf0 [0053.288] GetSystemMetrics (nIndex=42) returned 0 [0053.288] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e688 | out: ppMalloc=0x6610e688*=0x75e4d000) returned 0x0 [0053.288] IMalloc:Alloc (This=0x75e4d000, cb=0x4) returned 0x61dfe0 [0053.288] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f960, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0053.288] lstrcatA (in: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", lpString2=".cfg" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe.cfg") returned="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe.cfg" [0053.288] SetLastError (dwErrCode=0x0) [0053.288] SearchPathA (in: lpPath=0x0, lpFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x19f85c, lpFilePart=0x19f830 | out: lpBuffer="", lpFilePart=0x19f830*="\x8bÿU\x8bì\x83ì\x1cS\x8b]\x0cVWÆEÿ") returned 0x0 [0053.289] SetLastError (dwErrCode=0x2) [0053.289] GetLastError () returned 0x2 [0053.289] lstrcmpiA (lpString1="GASAS", lpString2="MTX") returned -1 [0053.289] lstrcmpiA (lpString1="GASAS", lpString2="DLLHOST") returned 1 [0053.289] lstrcmpiA (lpString1="GASAS", lpString2="INETINFO") returned -1 [0053.289] lstrcmpiA (lpString1="GASAS", lpString2="W3WP") returned -1 [0053.289] lstrcmpiA (lpString1="GASAS", lpString2="ASPNET_WP") returned 1 [0053.289] lstrcmpiA (lpString1="GASAS", lpString2="DLLHST3G") returned 1 [0053.289] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19f954, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0053.289] lstrcmpiA (lpString1="GASAS", lpString2="IEXPLORE") returned -1 [0053.289] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x74440000 [0053.295] GetLastError () returned 0x0 [0053.295] GetProcAddress (hModule=0x74440000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x744a9bc0 [0053.296] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19fea4, cbMultiByte=-1, lpWideCharStr=0x19fea0, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0053.296] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1c) returned 0x5f1e28 [0053.296] CoRegisterMessageFilter (in: lpMessageFilter=0x5f1e2c, lplpMessageFilter=0x5f1e34 | out: lplpMessageFilter=0x5f1e34*=0x0) returned 0x0 [0053.296] IUnknown:AddRef (This=0x5f1e2c) returned 0x2 [0053.296] GetClassInfoExA (in: hInstance=0x66000000, lpszClass="ThunderRT6Main", lpwcx=0x19fe70 | out: lpwcx=0x19fe70) returned 0 [0053.296] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x1c01a9 [0053.298] GetModuleHandleA (lpModuleName="USER32") returned 0x74b70000 [0053.298] GetProcAddress (hModule=0x74b70000, lpProcName="GetSystemMetrics") returned 0x74b9ddc0 [0053.298] GetProcAddress (hModule=0x74b70000, lpProcName="MonitorFromWindow") returned 0x74b85c10 [0053.298] GetProcAddress (hModule=0x74b70000, lpProcName="MonitorFromRect") returned 0x74b85820 [0053.298] GetProcAddress (hModule=0x74b70000, lpProcName="MonitorFromPoint") returned 0x74b86810 [0053.298] GetProcAddress (hModule=0x74b70000, lpProcName="EnumDisplayMonitors") returned 0x74ba32e0 [0053.298] GetProcAddress (hModule=0x74b70000, lpProcName="GetMonitorInfoA") returned 0x74b9df30 [0053.298] GetSystemMetrics (nIndex=0) returned 1440 [0053.298] GetSystemMetrics (nIndex=78) returned 1440 [0053.298] GetSystemMetrics (nIndex=1) returned 900 [0053.298] GetSystemMetrics (nIndex=79) returned 900 [0053.298] GetSystemMetrics (nIndex=50) returned 16 [0053.299] GetSystemMetrics (nIndex=49) returned 16 [0053.299] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0xa022d [0053.299] RegisterClassExA (param_1=0x19fe70) returned 0xc170 [0053.300] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x901ec [0053.304] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x81, wParam=0x0, lParam=0x19f9e0) returned 0x1 [0053.310] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x83, wParam=0x0, lParam=0x19f9cc) returned 0x0 [0053.310] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x1, wParam=0x0, lParam=0x19f9e0) returned 0x0 [0053.310] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0053.310] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0053.310] MonitorFromWindow (hwnd=0x901ec, dwFlags=0x2) returned 0x10001 [0053.310] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x19fe78 | out: lpmi=0x19fe78) returned 1 [0053.310] SetWindowPos (hWnd=0x901ec, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0053.310] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x46, wParam=0x0, lParam=0x19fe1c) returned 0x0 [0053.312] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x47, wParam=0x0, lParam=0x19fe1c) returned 0x0 [0053.312] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0053.312] ShowWindow (hWnd=0x901ec, nCmdShow=4) returned 0 [0053.312] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0053.312] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x46, wParam=0x0, lParam=0x19fe2c) returned 0x0 [0053.317] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x47, wParam=0x0, lParam=0x19fe2c) returned 0x0 [0053.317] GetWindowThreadProcessId (in: hWnd=0x901ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4c8 [0053.317] VirtualQuery (in: lpAddress=0x19fea0, lpBuffer=0x19fe84, dwLength=0x1c | out: lpBuffer=0x19fe84*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0053.317] GetUserDefaultLCID () returned 0x409 [0053.317] IsValidCodePage (CodePage=0x3a4) returned 1 [0053.317] IsValidCodePage (CodePage=0x3b5) returned 1 [0053.317] IsValidCodePage (CodePage=0x3b6) returned 1 [0053.317] IsValidCodePage (CodePage=0x3a8) returned 1 [0053.320] GetUserDefaultLangID () returned 0x409 [0053.320] GetSystemDefaultLangID () returned 0x620409 [0053.320] GetSystemMetrics (nIndex=42) returned 0 [0053.320] IMalloc:Alloc (This=0x75e4d000, cb=0xa8) returned 0x6193e8 [0053.320] IMalloc:GetSize (This=0x75e4d000, pv=0x6193e8) returned 0xa8 [0053.320] IMalloc:Alloc (This=0x75e4d000, cb=0xc) returned 0x61a688 [0053.320] GetCurrentThreadId () returned 0x4c8 [0053.320] IMalloc:Alloc (This=0x75e4d000, cb=0x3c) returned 0x621fe8 [0053.320] IMalloc:Alloc (This=0x75e4d000, cb=0x1c) returned 0x614b08 [0053.320] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x19fe6c | out: phkResult=0x19fe6c*=0x0) returned 0x2 [0053.321] IMalloc:Alloc (This=0x75e4d000, cb=0x1c) returned 0x61a168 [0053.321] GetCurrentThreadId () returned 0x4c8 [0053.321] SetWindowsHookExA (idHook=-1, lpfn=0x66061e09, hmod=0x0, dwThreadId=0x4c8) returned 0xc021f [0053.321] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x14) returned 0x5f1e50 [0053.321] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x80) returned 0x5f1e70 [0053.321] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x5f1ef8 [0053.321] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x2c) returned 0x5f1f10 [0053.321] GetClassInfoA (in: hInstance=0x66000000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x19fdc4 | out: lpWndClass=0x19fdc4) returned 0 [0053.321] RegisterClassA (lpWndClass=0x19fdc4) returned 0xc171 [0053.321] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x70044 [0053.321] NtdllDefWindowProc_A (hWnd=0x70044, Msg=0x81, wParam=0x0, lParam=0x19f990) returned 0x1 [0053.322] NtdllDefWindowProc_A (hWnd=0x70044, Msg=0x83, wParam=0x0, lParam=0x19f97c) returned 0x0 [0053.322] NtdllDefWindowProc_A (hWnd=0x70044, Msg=0x1, wParam=0x0, lParam=0x19f990) returned 0x0 [0053.322] NtdllDefWindowProc_A (hWnd=0x70044, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0053.322] NtdllDefWindowProc_A (hWnd=0x70044, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0053.324] SetWindowLongA (hWnd=0x70044, nIndex=0, dwNewLong=6233716) returned 0 [0053.324] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x38) returned 0x5f1f48 [0053.325] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x18) returned 0x5f1f88 [0053.325] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x5f1fa8 [0053.325] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0053.325] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0053.325] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0053.325] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0053.325] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0053.325] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0053.325] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0053.325] CreateCompatibleDC (hdc=0x0) returned 0x3c01052a [0053.325] GetCurrentObject (hdc=0x3c01052a, type=0x7) returned 0x85000f [0053.325] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x901ec, hMenu=0x0, hInstance=0x66000000, lpParam=0x0) returned 0x8002e [0053.325] NtdllDefWindowProc_A (hWnd=0x8002e, Msg=0x81, wParam=0x0, lParam=0x19fa20) returned 0x1 [0053.326] NtdllDefWindowProc_A (hWnd=0x8002e, Msg=0x83, wParam=0x0, lParam=0x19fa0c) returned 0x0 [0053.326] NtdllDefWindowProc_A (hWnd=0x8002e, Msg=0x1, wParam=0x0, lParam=0x19fa20) returned 0x0 [0053.326] NtdllDefWindowProc_A (hWnd=0x8002e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0053.326] NtdllDefWindowProc_A (hWnd=0x8002e, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0053.326] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0x210, wParam=0x1, lParam=0x8002e) returned 0x0 [0053.326] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x18) returned 0x5f1fc0 [0053.326] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x114) returned 0x2b105a8 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x5c) returned 0x5f1fe8 [0053.327] GetCurrentThreadId () returned 0x4c8 [0053.327] GetCurrentThreadId () returned 0x4c8 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x10) returned 0x5f2050 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x30) returned 0x5f2068 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x434) returned 0x5f20a0 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x434) returned 0x5f24e0 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3c) returned 0x5f2920 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f2968 [0053.327] lstrlenA (lpString="VB") returned 2 [0053.327] lstrlenA (lpString="CommandButton") returned 13 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11) returned 0x5f2a88 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5f2aa8 [0053.327] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xd4) returned 0x5f2ad8 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x44) returned 0x5f2bb8 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1c8) returned 0x5f2c08 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x28) returned 0x5f2dd8 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f2e08 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x28) returned 0x5f2e28 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f2e58 [0053.328] lstrlenA (lpString="VB") returned 2 [0053.328] lstrlenA (lpString="OptionButton") returned 12 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x5f2f78 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5f2f90 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xd4) returned 0x5f2fc0 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4c) returned 0x5f30a0 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1c8) returned 0x5f30f8 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f32c8 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f32e8 [0053.328] lstrlenA (lpString="VB") returned 2 [0053.328] lstrlenA (lpString="ComboBox") returned 8 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x5f3408 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x108) returned 0x5f3420 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4c) returned 0x5f3530 [0053.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x230) returned 0x5f3588 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f37c0 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f37e0 [0053.329] lstrlenA (lpString="VB") returned 2 [0053.329] lstrlenA (lpString="Timer") returned 5 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x9) returned 0x5f3900 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xc) returned 0x5f3918 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x30) returned 0x5f3930 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4) returned 0x5f3968 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x9c) returned 0x5f3978 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f3a20 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f3a40 [0053.329] lstrlenA (lpString="VB") returned 2 [0053.329] lstrlenA (lpString="Printer") returned 7 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xb) returned 0x5f3b60 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xdc) returned 0x5f3b78 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f3c60 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f3c80 [0053.329] lstrlenA (lpString="VB") returned 2 [0053.329] lstrlenA (lpString="Form") returned 4 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x5f3da0 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x184) returned 0x5f3db0 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x7c) returned 0x5f3f40 [0053.329] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x2f8) returned 0x5f3fc8 [0053.330] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f2dd8, Size=0x50) returned 0x5f42c8 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f2dd8 [0053.330] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f2e28, Size=0x50) returned 0x5f4320 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f4378 [0053.330] lstrlenA (lpString="VB") returned 2 [0053.330] lstrlenA (lpString="Screen") returned 6 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x5f2e28 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x2c) returned 0x5f4498 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa0) returned 0x5f44d0 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f4578 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f4598 [0053.330] lstrlenA (lpString="VB") returned 2 [0053.330] lstrlenA (lpString="Clipboard") returned 9 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xd) returned 0x5f2e40 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1c) returned 0x5f46b8 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x68) returned 0x5f46e0 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f4750 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f4770 [0053.330] lstrlenA (lpString="VB") returned 2 [0053.330] lstrlenA (lpString="MDIForm") returned 7 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xb) returned 0x5f4890 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x184) returned 0x5f48a8 [0053.330] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x7c) returned 0x5f4a38 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x2f8) returned 0x5f4ac0 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f4dc0 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f4de0 [0053.331] lstrlenA (lpString="VB") returned 2 [0053.331] lstrlenA (lpString="App") returned 3 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x7) returned 0x5f2df8 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x84) returned 0x5f4f00 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x148) returned 0x5f4f90 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f50e0 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f5100 [0053.331] lstrlenA (lpString="VB") returned 2 [0053.331] lstrlenA (lpString="Shape") returned 5 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x9) returned 0x5f5220 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1c) returned 0x5f5238 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x68) returned 0x5f5260 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfc) returned 0x5f52d0 [0053.331] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f42c8, Size=0x78) returned 0x5f53d8 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f42c8 [0053.331] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f4320, Size=0x78) returned 0x5f5458 [0053.331] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f54d8 [0053.332] lstrlenA (lpString="VB") returned 2 [0053.332] lstrlenA (lpString="Data") returned 4 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x5f42e8 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xd8) returned 0x5f55f8 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x3c) returned 0x5f42f8 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1d8) returned 0x5f56d8 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f4340 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f58b8 [0053.332] lstrlenA (lpString="VB") returned 2 [0053.332] lstrlenA (lpString="UserControl") returned 11 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xf) returned 0x5f4360 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e4) returned 0x5f59d8 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xb0) returned 0x5f5bc8 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x3a4) returned 0x5f5c80 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f6030 [0053.332] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f8f80 [0053.333] lstrlenA (lpString="VB") returned 2 [0053.333] lstrlenA (lpString="PropertyPage") returned 12 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x5f04a0 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x190) returned 0x5f90a0 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x88) returned 0x5f04b8 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x310) returned 0x5f9238 [0053.333] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f0548 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5f9550 [0053.333] lstrlenA (lpString="VB") returned 2 [0053.333] lstrlenA (lpString="UserDocument") returned 12 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x5f0568 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1c8) returned 0x5f9670 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa8) returned 0x5f9840 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x370) returned 0x5f98f0 [0053.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9ed0 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x20) returned 0x5f0580 [0053.334] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x30) returned 0x2b106c8 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa0) returned 0x5fa470 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5fa518 [0053.334] GetCurrentThreadId () returned 0x4c8 [0053.334] GetCurrentThreadId () returned 0x4c8 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x10) returned 0x5fa548 [0053.334] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x30) returned 0x2b10700 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xa0) returned 0x5fa560 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5fa608 [0053.334] GetCurrentThreadId () returned 0x4c8 [0053.334] GetCurrentThreadId () returned 0x4c8 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x10) returned 0x5fa638 [0053.334] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fa650 [0053.335] lstrlenA (lpString="VB") returned 2 [0053.335] lstrlenA (lpString="PictureBox") returned 10 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x5fa8b8 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x16c) returned 0x5fa978 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x68) returned 0x5faaf0 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x2c8) returned 0x5fab60 [0053.335] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f53d8, Size=0xa0) returned 0x5fae30 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9e70 [0053.335] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5f5458, Size=0xa0) returned 0x5faed8 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5faf80 [0053.335] lstrlenA (lpString="VB") returned 2 [0053.335] lstrlenA (lpString="Label") returned 5 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x9) returned 0x5fa7c8 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x34) returned 0x5f53d8 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xf0) returned 0x5fb0a0 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x48) returned 0x5f5418 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1f4) returned 0x5fb198 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9d90 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fc1a0 [0053.335] lstrlenA (lpString="VB") returned 2 [0053.335] lstrlenA (lpString="TextBox") returned 7 [0053.335] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xb) returned 0x5fa8d0 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x38) returned 0x5f5468 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x120) returned 0x5fc3a0 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x60) returned 0x5fc4c8 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x250) returned 0x5fc530 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9f10 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fbe28 [0053.336] lstrlenA (lpString="VB") returned 2 [0053.336] lstrlenA (lpString="Frame") returned 5 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x9) returned 0x5fa900 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x24) returned 0x5f54a8 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xb0) returned 0x5fc788 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x34) returned 0x5fc840 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x184) returned 0x5fc880 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9e10 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fb988 [0053.336] lstrlenA (lpString="VB") returned 2 [0053.336] lstrlenA (lpString="CheckBox") returned 8 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x5fa888 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5fca10 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xec) returned 0x5fca40 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x48) returned 0x5fcb38 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1f8) returned 0x5fcb88 [0053.336] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9d50 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fbab0 [0053.337] lstrlenA (lpString="VB") returned 2 [0053.337] lstrlenA (lpString="ListBox") returned 7 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xb) returned 0x5fa840 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x108) returned 0x5fcd88 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x54) returned 0x5fce98 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x230) returned 0x5fcef8 [0053.337] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fae30, Size=0xc8) returned 0x5fd130 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5fa050 [0053.337] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5faed8, Size=0xc8) returned 0x5fd200 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fbf50 [0053.337] lstrlenA (lpString="VB") returned 2 [0053.337] lstrlenA (lpString="HScrollBar") returned 10 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x5fa7e0 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x24) returned 0x5fae30 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x90) returned 0x5fae60 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5faef8 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x144) returned 0x5fd2d0 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9df0 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fc078 [0053.337] lstrlenA (lpString="VB") returned 2 [0053.337] lstrlenA (lpString="VScrollBar") returned 10 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x5fa7b0 [0053.337] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x24) returned 0x5faf28 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x90) returned 0x5fd420 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5fd4b8 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x144) returned 0x5fd4e8 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9cb0 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fbbd8 [0053.338] lstrlenA (lpString="VB") returned 2 [0053.338] lstrlenA (lpString="DriveListBox") returned 12 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x5fa8a0 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5fd638 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xc0) returned 0x5fd668 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x40) returned 0x5fd730 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1a0) returned 0x5fd778 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9e50 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fb4e8 [0053.338] lstrlenA (lpString="VB") returned 2 [0053.338] lstrlenA (lpString="DirListBox") returned 10 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x5fa960 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5fd920 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xc8) returned 0x5fd950 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x50) returned 0x5fda20 [0053.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1b0) returned 0x5fda78 [0053.339] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9f30 [0053.339] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fb3c0 [0053.339] lstrlenA (lpString="VB") returned 2 [0053.339] lstrlenA (lpString="FileListBox") returned 11 [0053.339] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xf) returned 0x5fa798 [0053.339] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x28) returned 0x5fdc30 [0053.339] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xec) returned 0x5fdc60 [0053.339] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x58) returned 0x5fdd58 [0053.339] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1f8) returned 0x5fddb8 [0053.340] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fd130, Size=0xf0) returned 0x5fdfb8 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9db0 [0053.341] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x5fd200, Size=0xf0) returned 0x5fe0b0 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fb738 [0053.341] lstrlenA (lpString="VB") returned 2 [0053.341] lstrlenA (lpString="Menu") returned 4 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x5faf58 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x38) returned 0x5fd130 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x4) returned 0x5faf68 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xb8) returned 0x5fd170 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9e30 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fbd00 [0053.341] lstrlenA (lpString="VB") returned 2 [0053.341] lstrlenA (lpString="Line") returned 4 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x5fd230 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x18) returned 0x5f9dd0 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x50) returned 0x5fd240 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xd0) returned 0x5fe1a8 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9e90 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fb610 [0053.341] lstrlenA (lpString="VB") returned 2 [0053.341] lstrlenA (lpString="Image") returned 5 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x9) returned 0x5fa918 [0053.341] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x24) returned 0x5fd298 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x98) returned 0x5fe280 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x34) returned 0x5fe320 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x154) returned 0x5fe360 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9cd0 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x114) returned 0x5fb860 [0053.342] lstrlenA (lpString="VB") returned 2 [0053.342] lstrlenA (lpString="OLE") returned 3 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x7) returned 0x5fe4c0 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x17c) returned 0x5fe4d0 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x40) returned 0x5fe658 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x2f0) returned 0x5fe6a0 [0053.342] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9eb0 [0053.342] IMalloc:Alloc (This=0x75e4d000, cb=0x64) returned 0x614230 [0053.343] IMalloc:Alloc (This=0x75e4d000, cb=0x64) returned 0x61a3f0 [0053.343] IMalloc:Alloc (This=0x75e4d000, cb=0xc) returned 0x61a6a0 [0053.343] IMalloc:Alloc (This=0x75e4d000, cb=0x40) returned 0x622198 [0053.343] IMalloc:GetSize (This=0x75e4d000, pv=0x622198) returned 0x40 [0053.343] IMalloc:Alloc (This=0x75e4d000, cb=0x20) returned 0x631ae0 [0053.343] GetCurrentThreadId () returned 0x4c8 [0053.343] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x54) returned 0x5fe998 [0053.343] GetCurrentThreadId () returned 0x4c8 [0053.343] IMalloc:Alloc (This=0x75e4d000, cb=0x1c) returned 0x631cc0 [0053.343] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x104) returned 0x5fe9f8 [0053.343] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x6f8) returned 0x2970048 [0053.343] VirtualProtect (in: lpAddress=0x4b0000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x19fdf0 | out: lpflOldProtect=0x19fdf0*=0x20) returned 1 [0053.344] GetCurrentProcess () returned 0xffffffff [0053.344] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x4b0000, dwSize=0x6000) returned 1 [0053.344] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.344] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.344] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xd4) returned 0x5feb08 [0053.344] VirtualAlloc (lpAddress=0x4b0000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.344] VirtualAlloc (lpAddress=0x4b0000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000 [0053.344] VirtualProtect (in: lpAddress=0x4b0000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x19fdf0 | out: lpflOldProtect=0x19fdf0*=0x4) returned 1 [0053.346] GetCurrentProcess () returned 0xffffffff [0053.346] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x4b0000, dwSize=0xa000) returned 1 [0053.346] GetCurrentThreadId () returned 0x4c8 [0053.346] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x23ec) returned 0x2970748 [0053.354] GetCurrentThreadId () returned 0x4c8 [0053.354] SetWindowTextA (hWnd=0x901ec, lpString="AMMIccova") returned 1 [0053.354] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0xc, wParam=0x0, lParam=0x19fd64) returned 0x1 [0053.354] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x19fd4c | out: phkResult=0x19fd4c*=0x0) returned 0x2 [0053.355] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0053.355] VirtualQuery (in: lpAddress=0x19f778, lpBuffer=0x19f75c, dwLength=0x1c | out: lpBuffer=0x19f75c*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0053.356] IMalloc:Alloc (This=0x75e4d000, cb=0x70) returned 0x6104a0 [0053.356] IMalloc:GetSize (This=0x75e4d000, pv=0x6104a0) returned 0x70 [0053.356] GetCurrentThreadId () returned 0x4c8 [0053.356] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x104) returned 0x5febe8 [0053.356] GetCurrentThreadId () returned 0x4c8 [0053.356] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x1e4) returned 0x5fecf8 [0053.356] GetCurrentThreadId () returned 0x4c8 [0053.357] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.358] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.358] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.358] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.358] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.358] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\Qq8qgKOGJS647hpO52iTYfl2VuxTiMIviymZS1Bv239\\U30031", phkResult=0x19f634 | out: phkResult=0x19f634*=0x168) returned 0x0 [0053.358] RegSetValueExW (in: hKey=0x168, lpValueName="mtJmC38VTGaknjdtgXFivhKaQE254", Reserved=0x0, dwType=0x1, lpData="aUzRm9ANNmLdZLT142", cbData=0x26 | out: lpData="aUzRm9ANNmLdZLT142") returned 0x0 [0053.359] RegCloseKey (hKey=0x168) returned 0x0 [0053.359] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\XDGbUtcIkuCnSu29IJe2TXzfQCeyhqEYe7188\\XBFHlTPtCBfKqs9UwI2zObKfEsV5hgA4Hh5dy6", phkResult=0x19f634 | out: phkResult=0x19f634*=0x168) returned 0x0 [0053.359] RegSetValueExW (in: hKey=0x168, lpValueName="D9fKO4rBg0Xe00yWzx64", Reserved=0x0, dwType=0x1, lpData="cJvoQ8rudn14FAVZhSWGhU20GSLamAK76RyVc208", cbData=0x52 | out: lpData="cJvoQ8rudn14FAVZhSWGhU20GSLamAK76RyVc208") returned 0x0 [0053.359] RegCloseKey (hKey=0x168) returned 0x0 [0053.359] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\hEDo8dNvhHUQvueTszwLUnVhm248\\ihlxxKCSc114", phkResult=0x19f634 | out: phkResult=0x19f634*=0x168) returned 0x0 [0053.359] RegSetValueExW (in: hKey=0x168, lpValueName="Cxx6Y7Zs3GcpIoe5D4bvOsoWuJVA8gb161", Reserved=0x0, dwType=0x1, lpData="seNnXHIR5TGAl5rAFiqWYEV4XMxteFUyE132", cbData=0x4a | out: lpData="seNnXHIR5TGAl5rAFiqWYEV4XMxteFUyE132") returned 0x0 [0053.359] RegCloseKey (hKey=0x168) returned 0x0 [0053.359] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\Te3ta8i8q1Yjl4yyWE4xFCZE233\\P2FE5QM162", phkResult=0x19f634 | out: phkResult=0x19f634*=0x168) returned 0x0 [0053.359] RegSetValueExW (in: hKey=0x168, lpValueName="xBpB7s179", Reserved=0x0, dwType=0x1, lpData="HkDATmWDXM5h8bkqer8AlBoPN245jO1HwnZ245", cbData=0x4e | out: lpData="HkDATmWDXM5h8bkqer8AlBoPN245jO1HwnZ245") returned 0x0 [0053.359] RegCloseKey (hKey=0x168) returned 0x0 [0053.359] RegCreateKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\bxhZLGpbIzTFIo67mIxT7vkltx9kr7eXfRHCiWcf176\\a8OJ1cZl0362", phkResult=0x19f634 | out: phkResult=0x19f634*=0x168) returned 0x0 [0053.359] RegSetValueExW (in: hKey=0x168, lpValueName="G8ocOUVksYXSbZwykiJNccGaAHsfoluxGm8LK5127", Reserved=0x0, dwType=0x1, lpData="hjm06lZ75", cbData=0x14 | out: lpData="hjm06lZ75") returned 0x0 [0053.359] RegCloseKey (hKey=0x168) returned 0x0 [0053.360] VarCmp (pvarLeft=0x19f808, pvarRight=0x19f7b8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.360] GetUserDefaultLCID () returned 0x409 [0053.360] SafeArrayCopy (in: psa=0x621088, ppsaOut=0x19f86c | out: ppsaOut=0x19f86c) returned 0x0 [0053.360] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.361] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.361] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.361] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.361] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.361] VarBstrCmp (bstrLeft="G", bstrRight="G", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.361] GetUserDefaultLCID () returned 0x409 [0053.361] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0053.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x61a794, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.361] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.362] GetUserDefaultLCID () returned 0x409 [0053.362] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0053.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x61a794, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.362] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.362] GetUserDefaultLCID () returned 0x409 [0053.362] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0053.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x61a794, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.362] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.362] GetUserDefaultLCID () returned 0x409 [0053.362] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0053.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x61a794, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.362] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.362] GetUserDefaultLCID () returned 0x409 [0053.362] VarI4FromStr (in: strIn="97", lcid=0x409, dwFlags=0x0, plOut=0x19f640 | out: plOut=0x19f640) returned 0x0 [0053.362] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f64c, cbMultiByte=1, lpWideCharStr=0x61a794, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0053.362] VarBstrCmp (bstrLeft="a", bstrRight="a", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.362] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.363] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.363] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.363] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.363] VarBstrCmp (bstrLeft="String", bstrRight="String", lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.364] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0xfc) returned 0x2972b40 [0053.364] GetVersionExA (in: lpVersionInformation=0x19f4c0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x3f4, dwMinorVersion=0x1f664aa, dwBuildNumber=0x5f00c0, dwPlatformId=0x0, szCSDVersion="0ù\x19") | out: lpVersionInformation=0x19f4c0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0053.364] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0053.364] GetCurrentThreadId () returned 0x4c8 [0053.364] GetCurrentThreadId () returned 0x4c8 [0053.364] GetCurrentThreadId () returned 0x4c8 [0053.364] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x5fa7f8 [0053.364] SetWindowTextA (hWnd=0x901ec, lpString="AMMIccova") returned 1 [0053.364] NtdllDefWindowProc_A (hWnd=0x901ec, Msg=0xc, wParam=0x0, lParam=0x5fa7f8) returned 0x1 [0053.364] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1) returned 0x5feee8 [0053.364] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x5fa858 [0053.364] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x5fa870 [0053.365] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x8, Size=0x15) returned 0x5f9f50 [0053.365] LoadLibraryA (lpLibFileName="VERSION.DLL") returned 0x74430000 [0053.367] GetLastError () returned 0x0 [0053.367] GetProcAddress (hModule=0x74430000, lpProcName="VerQueryValueA") returned 0x744314f0 [0053.367] GetProcAddress (hModule=0x74430000, lpProcName="GetFileVersionInfoSizeA") returned 0x744314d0 [0053.368] GetProcAddress (hModule=0x74430000, lpProcName="GetFileVersionInfoA") returned 0x744314b0 [0053.368] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f46c, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0053.368] GetFileVersionInfoSizeA (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", lpdwHandle=0x19f5ac | out: lpdwHandle=0x19f5ac) returned 0x4e4 [0053.368] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4e4) returned 0x2972c48 [0053.368] GetFileVersionInfoA (in: lptstrFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwHandle=0x0, dwLen=0x4e4, lpData=0x2972c48 | out: lpData=0x2972c48) returned 1 [0053.368] VerQueryValueA (in: pBlock=0x2972c48, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f5a4, puLen=0x19f5b4 | out: lplpBuffer=0x19f5a4*=0x2972ce4, puLen=0x19f5b4) returned 1 [0053.368] wsprintfA (in: param_1=0x19f570, param_2="\\StringFileInfo\\%04x%04x\\%s" | out: param_1="\\StringFileInfo\\040904b0\\LegalTrademarks") returned 40 [0053.368] VerQueryValueA (in: pBlock=0x2972c48, lpSubBlock="\\StringFileInfo\\040904b0\\LegalTrademarks", lplpBuffer=0x19f5a8, puLen=0x19f5b4 | out: lplpBuffer=0x19f5a8*=0x19f5d4, puLen=0x19f5b4) returned 0 [0053.368] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x2972c48 | out: hHeap=0x5f0000) returned 1 [0053.368] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1) returned 0x5feef8 [0053.368] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5feef8 | out: hHeap=0x5f0000) returned 1 [0053.369] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0053.369] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.369] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0053.369] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.369] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0053.369] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.370] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0053.370] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.370] VarUdateFromDate (in: dateIn=0x0, dwFlags=0x40e20380, pudateOut=0x0 | out: pudateOut=0x0) returned 0x0 [0053.370] VarCmp (pvarLeft=0x19f7f8, pvarRight=0x19f7c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0053.370] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f4ac, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0053.565] lstrcpynA (in: lpString1=0x19f398, lpString2="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", iMaxLength=260 | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe") returned="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" [0053.565] lstrlenA (lpString="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe") returned 33 [0053.565] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x22) returned 0x5feef8 [0053.565] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x22) returned 0x5fef28 [0053.565] lstrcpyA (in: lpString1=0x5feef8, lpString2="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" | out: lpString1="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe") returned="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" [0053.566] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x5fef58 [0053.566] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5fef28 | out: hHeap=0x5f0000) returned 1 [0053.566] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5feef8 | out: hHeap=0x5f0000) returned 1 [0053.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5fef58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0053.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x5fef58, cbMultiByte=-1, lpWideCharStr=0x631c9c, cchWideChar=6 | out: lpWideCharStr="GASAS") returned 6 [0053.566] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5fef58 | out: hHeap=0x5f0000) returned 1 [0053.566] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\VB and VBA Program Settings\\GASAS\\BLOCKHgareth", phkResult=0x19f628 | out: phkResult=0x19f628*=0x0) returned 0x2 [0053.566] RegCloseKey (hKey=0x0) returned 0x6 [0053.567] SafeArrayCopy (in: psa=0x621388, ppsaOut=0x19f8b8 | out: ppsaOut=0x19f8b8) returned 0x0 [0053.567] GetUserDefaultLCID () returned 0x409 [0053.567] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0053.567] GetUserDefaultLCID () returned 0x409 [0053.567] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0053.567] GetUserDefaultLCID () returned 0x409 [0053.567] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0053.567] GetUserDefaultLCID () returned 0x409 [0053.567] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0053.567] GetUserDefaultLCID () returned 0x409 [0053.567] VarI2FromStr (in: strIn="2", lcid=0x409, dwFlags=0x0, psOut=0x19f636 | out: psOut=0x19f636) returned 0x0 [0053.615] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x40) returned 0x4e0000 [0055.053] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.053] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0055.053] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.053] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0055.053] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.053] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0055.054] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.054] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0055.054] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.054] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0055.054] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.054] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0055.054] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.054] LoadLibraryA (lpLibFileName="user32") returned 0x74b70000 [0055.054] SetErrorMode (uMode=0x8001) returned 0x8001 [0055.054] GetProcAddress (hModule=0x74b70000, lpProcName="EnumWindows") returned 0x74b8a3c0 [0055.054] EnumWindows (lpEnumFunc=0x4e043e, lParam=0x19f648) returned 1 [0055.056] GetTickCount () returned 0x114e3e9 [0055.056] Sleep (dwMilliseconds=0x7d0) [0057.079] GetTickCount () returned 0x114ebc8 [0057.080] SetErrorMode (uMode=0x8001) returned 0x8001 [0057.080] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.080] SetErrorMode (uMode=0x8001) returned 0x8001 [0057.080] GetProcAddress (hModule=0x75e90000, lpProcName="SetErrorMode") returned 0x75ea6500 [0057.080] SetErrorMode (uMode=0x800) returned 0x8001 [0057.080] SetErrorMode (uMode=0x0) returned 0x800 [0057.080] SetErrorMode (uMode=0x8001) returned 0x0 [0057.080] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.080] SetErrorMode (uMode=0x0) returned 0x8001 [0057.080] GetProcAddress (hModule=0x75e90000, lpProcName="SetLastError") returned 0x75ea4f00 [0057.080] SetLastError (dwErrCode=0x5) [0057.080] SetErrorMode (uMode=0x8001) returned 0x0 [0057.081] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.081] SetErrorMode (uMode=0x0) returned 0x8001 [0057.081] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0057.081] SetErrorMode (uMode=0x8001) returned 0x0 [0057.081] LoadLibraryA (lpLibFileName="shell32") returned 0x76480000 [0057.099] SetErrorMode (uMode=0x0) returned 0x8001 [0057.099] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteW") returned 0x765e42e0 [0057.100] SetErrorMode (uMode=0x8001) returned 0x0 [0057.100] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.100] SetErrorMode (uMode=0x0) returned 0x8001 [0057.100] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0057.100] SetErrorMode (uMode=0x8001) returned 0x0 [0057.100] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.100] SetErrorMode (uMode=0x0) returned 0x8001 [0057.100] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0057.100] SetErrorMode (uMode=0x8001) returned 0x0 [0057.100] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.100] SetErrorMode (uMode=0x0) returned 0x8001 [0057.100] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtectEx") returned 0x75ea6a50 [0057.100] SetErrorMode (uMode=0x8001) returned 0x0 [0057.100] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.100] SetErrorMode (uMode=0x0) returned 0x8001 [0057.101] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessInternalW") returned 0x75ea45f0 [0057.101] SetErrorMode (uMode=0x8001) returned 0x0 [0057.101] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.101] SetErrorMode (uMode=0x0) returned 0x8001 [0057.101] GetProcAddress (hModule=0x75e90000, lpProcName="GetTempPathW") returned 0x75efeff0 [0057.101] SetErrorMode (uMode=0x8001) returned 0x0 [0057.101] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.101] SetErrorMode (uMode=0x0) returned 0x8001 [0057.101] GetProcAddress (hModule=0x75e90000, lpProcName="GetLongPathNameW") returned 0x75ed1710 [0057.101] SetErrorMode (uMode=0x8001) returned 0x0 [0057.101] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.101] SetErrorMode (uMode=0x0) returned 0x8001 [0057.101] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSize") returned 0x75efef30 [0057.101] SetErrorMode (uMode=0x8001) returned 0x0 [0057.101] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.102] SetErrorMode (uMode=0x0) returned 0x8001 [0057.102] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0057.102] SetErrorMode (uMode=0x8001) returned 0x0 [0057.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.102] SetErrorMode (uMode=0x0) returned 0x8001 [0057.102] GetProcAddress (hModule=0x75e90000, lpProcName="ExitThread") returned 0x77c16390 [0057.102] SetErrorMode (uMode=0x8001) returned 0x0 [0057.103] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.103] SetErrorMode (uMode=0x0) returned 0x8001 [0057.103] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0057.103] GetCurrentThread () returned 0xfffffffe [0057.103] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x4ed093*=0x7ff931f41000, NumberOfBytesToProtect=0x4ed08b, NewAccessProtection=0x40, OldAccessProtection=0x4ed083 | out: BaseAddress=0x4ed093*=0x7ff931f41000, NumberOfBytesToProtect=0x4ed08b, OldAccessProtection=0x4ed083*=0x20) returned 0x0 [0057.184] SetErrorMode (uMode=0x8001) returned 0x0 [0057.185] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.185] SetErrorMode (uMode=0x0) returned 0x8001 [0057.185] GetProcAddress (hModule=0x77bb0000, lpProcName="NtProtectVirtualMemory") returned 0x77c22210 [0057.186] SetErrorMode (uMode=0x8001) returned 0x0 [0057.186] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.186] SetErrorMode (uMode=0x0) returned 0x8001 [0057.186] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgBreakPoint") returned 0x77c23fb0 [0057.187] SetErrorMode (uMode=0x8001) returned 0x0 [0057.187] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.187] SetErrorMode (uMode=0x0) returned 0x8001 [0057.187] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgUiRemoteBreakin") returned 0x77c5a520 [0057.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, NewAccessProtection=0x40, OldAccessProtection=0x19f638 | out: BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, OldAccessProtection=0x19f638*=0x20) returned 0x0 [0057.272] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, NewAccessProtection=0x20, OldAccessProtection=0x19f638 | out: BaseAddress=0x19f630*=0x77bb1000, NumberOfBytesToProtect=0x19f634, OldAccessProtection=0x19f638*=0x80) returned 0x0 [0057.590] SetErrorMode (uMode=0x8001) returned 0x0 [0057.590] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.591] SetErrorMode (uMode=0x0) returned 0x8001 [0057.591] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetInformationThread") returned 0x77c21dc0 [0057.596] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0057.596] SetErrorMode (uMode=0x8001) returned 0x0 [0057.596] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.596] SetErrorMode (uMode=0x0) returned 0x8001 [0057.596] GetProcAddress (hModule=0x77bb0000, lpProcName="NtAllocateVirtualMemory") returned 0x77c21e70 [0057.601] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f9ac*=0x0, ZeroBits=0x0, RegionSize=0x19f9a8*=0x1c200000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19f9ac*=0x2b20000, RegionSize=0x19f9a8*=0x1c200000) returned 0x0 [0057.651] SetErrorMode (uMode=0x8001) returned 0x0 [0057.654] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.655] SetErrorMode (uMode=0x0) returned 0x8001 [0057.655] GetProcAddress (hModule=0x77bb0000, lpProcName="NtGetContextThread") returned 0x77c22ba0 [0057.655] SetErrorMode (uMode=0x8001) returned 0x0 [0057.655] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.655] SetErrorMode (uMode=0x0) returned 0x8001 [0057.655] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetContextThread") returned 0x77c234f0 [0057.661] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19f9ac*=0x0, ZeroBits=0x0, RegionSize=0x19f9a8*=0x1d2c, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19f9ac*=0x4f0000, RegionSize=0x19f9a8*=0x2000) returned 0x0 [0057.690] SetErrorMode (uMode=0x8001) returned 0x0 [0057.690] LoadLibraryA (lpLibFileName="user32") returned 0x74b70000 [0057.690] SetErrorMode (uMode=0x0) returned 0x8001 [0057.690] GetProcAddress (hModule=0x74b70000, lpProcName="GetCursorPos") returned 0x74b8dcc0 [0057.695] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2b24004 | out: Context=0x2b24004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0057.745] GetCursorPos (in: lpPoint=0x2b2004c | out: lpPoint=0x2b2004c*(x=1418, y=135)) returned 1 [0057.745] Sleep (dwMilliseconds=0x1) [0057.799] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2b24004 | out: Context=0x2b24004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0057.799] GetCursorPos (in: lpPoint=0x2b2004c | out: lpPoint=0x2b2004c*(x=1418, y=135)) returned 1 [0057.804] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2b24004 | out: Context=0x2b24004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0057.804] CreateProcessInternalW (in: hUserToken=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", lpCommandLine="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2b20048*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2b2008c, hNewToken=0x0 | out: lpProcessInformation=0x2b2008c*(hProcess=0x204, hThread=0x200, dwProcessId=0x770, dwThreadId=0xf0c), hNewToken=0x0) returned 1 [0057.816] NtGetContextThread (in: ThreadHandle=0x200, Context=0x2b2009c | out: Context=0x2b2009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x344000, Edx=0x0, Ecx=0x0, Eax=0x401350, Ebp=0x0, Eip=0x77c24210, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0057.866] NtSetContextThread (ThreadHandle=0x200, Context=0x2b2009c*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x344000, Edx=0x0, Ecx=0x0, Eax=0x47682a, Ebp=0x0, Eip=0x77c24210, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0057.868] SetErrorMode (uMode=0x8001) returned 0x0 [0057.869] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0057.869] SetErrorMode (uMode=0x0) returned 0x8001 [0057.869] GetProcAddress (hModule=0x77bb0000, lpProcName="NtResumeThread") returned 0x77c22230 [0057.874] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2b24004 | out: Context=0x2b24004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0057.878] NtResumeThread (in: ThreadHandle=0x200, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0057.878] SetErrorMode (uMode=0x8001) returned 0x0 [0057.878] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0057.878] SetErrorMode (uMode=0x0) returned 0x8001 [0057.878] GetProcAddress (hModule=0x75e90000, lpProcName="GetExitCodeProcess") returned 0x75ea3c60 [0057.879] GetExitCodeProcess (in: hProcess=0x204, lpExitCode=0x2b207fc | out: lpExitCode=0x2b207fc*=0x103) returned 1 [0057.880] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 7 os_tid = 0xeec Process: id = "4" image_name = "gasas.exe" filename = "c:\\users\\fd1hvy\\desktop\\gasas.exe" page_root = "0x1ac56000" os_pid = "0x770" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xd98" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0xf0c [0058.579] GetVersion () returned 0x23f00206 [0058.580] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0058.580] GetProcAddress (hModule=0x75e90000, lpProcName="IsTNT") returned 0x0 [0058.580] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x5d0000 [0058.598] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x2000000 [0058.598] VirtualAlloc (lpAddress=0x2000000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2000000 [0058.600] GetCurrentThreadId () returned 0xf0c [0058.600] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\GASAS.exe\"" [0058.600] GetEnvironmentStringsW () returned 0x771490* [0058.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379 [0058.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x570) returned 0x5d05a8 [0058.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x5d05a8, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1379 [0058.600] FreeEnvironmentStringsW (penv=0x771490) returned 1 [0058.600] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x0, Size=0x480) returned 0x5d0b20 [0058.600] GetStartupInfoA (in: lpStartupInfo=0x19f8c4 | out: lpStartupInfo=0x19f8c4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0058.600] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0058.600] GetFileType (hFile=0x0) returned 0x0 [0058.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0058.600] GetFileType (hFile=0x0) returned 0x0 [0058.600] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0058.600] GetFileType (hFile=0x0) returned 0x0 [0058.600] SetHandleCount (uNumber=0x20) returned 0x20 [0058.600] GetACP () returned 0x4e4 [0058.600] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8ec | out: lpCPInfo=0x19f8ec) returned 1 [0058.600] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x6610c528, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0058.602] HeapFree (in: hHeap=0x5d0000, dwFlags=0x0, lpMem=0x5d05a8 | out: hHeap=0x5d0000) returned 1 [0058.602] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x75e90000 [0058.602] GetProcAddress (hModule=0x75e90000, lpProcName="IsProcessorFeaturePresent") returned 0x75ea5960 [0058.602] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0058.602] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x800) returned 0x5d0fa8 [0058.603] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x12c [0058.603] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x130 [0058.603] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0058.603] GetModuleFileNameA (in: hModule=0x66000000, lpFilename=0x6610e6c8, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\SYSTEM32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0058.603] GetVersion () returned 0x23f00206 [0058.603] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0058.605] GetUserDefaultLCID () returned 0x409 [0058.605] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0058.605] GetSystemMetrics (nIndex=5) returned 1 [0058.605] GetSystemMetrics (nIndex=6) returned 1 [0058.605] GetSystemMetrics (nIndex=11) returned 32 [0058.605] GetSystemMetrics (nIndex=12) returned 32 [0058.605] GetSystemMetrics (nIndex=34) returned 136 [0058.605] GetSystemMetrics (nIndex=35) returned 39 [0058.605] GetSystemMetrics (nIndex=0) returned 1440 [0058.605] GetSystemMetrics (nIndex=1) returned 900 [0058.605] GetSystemMetrics (nIndex=32) returned 8 [0058.605] GetSystemMetrics (nIndex=33) returned 8 [0058.605] GetSystemMetrics (nIndex=42) returned 0 [0058.606] GetStockObject (i=15) returned 0x88000b [0058.606] GetStockObject (i=7) returned 0xb00017 [0058.606] GetStockObject (i=6) returned 0xb00018 [0058.606] GetStockObject (i=8) returned 0xb00016 [0058.606] GetStockObject (i=4) returned 0x900011 [0058.606] GetStockObject (i=2) returned 0x900012 [0058.606] GetStockObject (i=0) returned 0x900010 [0058.606] GetStockObject (i=5) returned 0x900015 [0058.606] GetStockObject (i=13) returned 0x8a01c2 [0058.606] GetDC (hWnd=0x0) returned 0x100106df [0058.606] GetTextExtentPointA (in: hdc=0x100106df, lpString="0", c=1, lpsz=0x19f8e8 | out: lpsz=0x19f8e8) returned 1 [0058.607] GetDeviceCaps (hdc=0x100106df, index=14) returned 1 [0058.607] GetDeviceCaps (hdc=0x100106df, index=12) returned 32 [0058.607] GetDeviceCaps (hdc=0x100106df, index=88) returned 96 [0058.607] GetDeviceCaps (hdc=0x100106df, index=90) returned 96 [0058.607] GetDeviceCaps (hdc=0x100106df, index=38) returned 32409 [0058.608] ReleaseDC (hWnd=0x0, hDC=0x100106df) returned 1 [0058.608] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x2920000 [0058.608] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x6610e7d0 | out: ppMalloc=0x6610e7d0*=0x75e4d000) returned 0x0 [0058.608] GetCurrentThreadId () returned 0xf0c [0058.890] VirtualAlloc (lpAddress=0x0, dwSize=0xe000, flAllocationType=0x1000, flProtect=0x40) returned 0x570000 [0061.985] SetErrorMode (uMode=0x8001) returned 0x0 [0061.985] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0061.985] SetErrorMode (uMode=0x0) returned 0x8001 [0061.985] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0061.985] SetErrorMode (uMode=0x8001) returned 0x0 [0061.985] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0061.985] SetErrorMode (uMode=0x0) returned 0x8001 [0061.985] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0061.985] SetErrorMode (uMode=0x8001) returned 0x0 [0061.985] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0061.985] SetErrorMode (uMode=0x0) returned 0x8001 [0061.986] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0061.986] SetErrorMode (uMode=0x8001) returned 0x0 [0061.986] LoadLibraryA (lpLibFileName="user32") returned 0x74b70000 [0061.986] SetErrorMode (uMode=0x0) returned 0x8001 [0061.986] GetProcAddress (hModule=0x74b70000, lpProcName="EnumWindows") returned 0x74b8a3c0 [0061.986] EnumWindows (lpEnumFunc=0x57043e, lParam=0x19fdb4) returned 1 [0061.988] GetTickCount () returned 0x114ff02 [0061.988] Sleep (dwMilliseconds=0x7d0) [0064.305] GetTickCount () returned 0x115080b [0064.305] SetErrorMode (uMode=0x8001) returned 0x0 [0064.306] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.309] SetErrorMode (uMode=0x0) returned 0x8001 [0064.309] GetProcAddress (hModule=0x75e90000, lpProcName="SetErrorMode") returned 0x75ea6500 [0064.309] SetErrorMode (uMode=0x800) returned 0x0 [0064.309] SetErrorMode (uMode=0x0) returned 0x800 [0064.309] SetErrorMode (uMode=0x8001) returned 0x0 [0064.309] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.309] SetErrorMode (uMode=0x0) returned 0x8001 [0064.309] GetProcAddress (hModule=0x75e90000, lpProcName="SetLastError") returned 0x75ea4f00 [0064.309] SetLastError (dwErrCode=0x5) [0064.309] SetErrorMode (uMode=0x8001) returned 0x0 [0064.309] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.309] SetErrorMode (uMode=0x0) returned 0x8001 [0064.309] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0064.309] SetErrorMode (uMode=0x8001) returned 0x0 [0064.309] LoadLibraryA (lpLibFileName="shell32") returned 0x76480000 [0064.332] SetErrorMode (uMode=0x0) returned 0x8001 [0064.332] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteW") returned 0x765e42e0 [0064.332] SetErrorMode (uMode=0x8001) returned 0x0 [0064.332] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.333] SetErrorMode (uMode=0x0) returned 0x8001 [0064.333] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0064.333] SetErrorMode (uMode=0x8001) returned 0x0 [0064.333] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.333] SetErrorMode (uMode=0x0) returned 0x8001 [0064.333] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0064.333] SetErrorMode (uMode=0x8001) returned 0x0 [0064.333] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.333] SetErrorMode (uMode=0x0) returned 0x8001 [0064.333] GetProcAddress (hModule=0x75e90000, lpProcName="VirtualProtectEx") returned 0x75ea6a50 [0064.333] SetErrorMode (uMode=0x8001) returned 0x0 [0064.333] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.333] SetErrorMode (uMode=0x0) returned 0x8001 [0064.333] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessInternalW") returned 0x75ea45f0 [0064.333] SetErrorMode (uMode=0x8001) returned 0x0 [0064.333] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.334] SetErrorMode (uMode=0x0) returned 0x8001 [0064.334] GetProcAddress (hModule=0x75e90000, lpProcName="GetTempPathW") returned 0x75efeff0 [0064.334] SetErrorMode (uMode=0x8001) returned 0x0 [0064.334] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.334] SetErrorMode (uMode=0x0) returned 0x8001 [0064.334] GetProcAddress (hModule=0x75e90000, lpProcName="GetLongPathNameW") returned 0x75ed1710 [0064.334] SetErrorMode (uMode=0x8001) returned 0x0 [0064.334] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.334] SetErrorMode (uMode=0x0) returned 0x8001 [0064.334] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSize") returned 0x75efef30 [0064.334] SetErrorMode (uMode=0x8001) returned 0x0 [0064.334] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.334] SetErrorMode (uMode=0x0) returned 0x8001 [0064.334] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0064.335] SetErrorMode (uMode=0x8001) returned 0x0 [0064.335] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.335] SetErrorMode (uMode=0x0) returned 0x8001 [0064.335] GetProcAddress (hModule=0x75e90000, lpProcName="ExitThread") returned 0x77c16390 [0064.335] SetErrorMode (uMode=0x8001) returned 0x0 [0064.335] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0064.335] SetErrorMode (uMode=0x0) returned 0x8001 [0064.335] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0064.335] GetCurrentThread () returned 0xfffffffe [0064.336] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x57d093*=0x7ff931f41000, NumberOfBytesToProtect=0x57d08b, NewAccessProtection=0x40, OldAccessProtection=0x57d083 | out: BaseAddress=0x57d093*=0x7ff931f41000, NumberOfBytesToProtect=0x57d08b, OldAccessProtection=0x57d083*=0x20) returned 0x0 [0064.720] SetErrorMode (uMode=0x8001) returned 0x0 [0064.720] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0064.720] SetErrorMode (uMode=0x0) returned 0x8001 [0064.720] GetProcAddress (hModule=0x77bb0000, lpProcName="NtProtectVirtualMemory") returned 0x77c22210 [0064.721] SetErrorMode (uMode=0x8001) returned 0x0 [0064.721] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0064.721] SetErrorMode (uMode=0x0) returned 0x8001 [0064.721] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgBreakPoint") returned 0x77c23fb0 [0064.721] SetErrorMode (uMode=0x8001) returned 0x0 [0064.721] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0064.721] SetErrorMode (uMode=0x0) returned 0x8001 [0064.721] GetProcAddress (hModule=0x77bb0000, lpProcName="DbgUiRemoteBreakin") returned 0x77c5a520 [0064.721] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, NewAccessProtection=0x40, OldAccessProtection=0x19fda4 | out: BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, OldAccessProtection=0x19fda4*=0x20) returned 0x0 [0064.900] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, NewAccessProtection=0x20, OldAccessProtection=0x19fda4 | out: BaseAddress=0x19fd9c*=0x77bb1000, NumberOfBytesToProtect=0x19fda0, OldAccessProtection=0x19fda4*=0x80) returned 0x0 [0065.484] SetErrorMode (uMode=0x8001) returned 0x0 [0065.484] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0065.485] SetErrorMode (uMode=0x0) returned 0x8001 [0065.485] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetInformationThread") returned 0x77c21dc0 [0065.489] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0065.489] SetErrorMode (uMode=0x8001) returned 0x0 [0065.490] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0065.490] SetErrorMode (uMode=0x0) returned 0x8001 [0065.490] GetProcAddress (hModule=0x77bb0000, lpProcName="NtAllocateVirtualMemory") returned 0x77c21e70 [0065.495] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fe2c*=0x0, ZeroBits=0x0, RegionSize=0x19fe28*=0x1c200000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19fe2c*=0x2930000, RegionSize=0x19fe28*=0x1c200000) returned 0x0 [0065.505] SetErrorMode (uMode=0x8001) returned 0x0 [0065.505] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0065.506] SetErrorMode (uMode=0x0) returned 0x8001 [0065.506] GetProcAddress (hModule=0x77bb0000, lpProcName="NtGetContextThread") returned 0x77c22ba0 [0065.506] SetErrorMode (uMode=0x8001) returned 0x0 [0065.506] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0065.506] SetErrorMode (uMode=0x0) returned 0x8001 [0065.506] GetProcAddress (hModule=0x77bb0000, lpProcName="NtSetContextThread") returned 0x77c234f0 [0065.506] SetErrorMode (uMode=0x8001) returned 0x0 [0065.506] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0065.506] SetErrorMode (uMode=0x0) returned 0x8001 [0065.506] GetProcAddress (hModule=0x75e90000, lpProcName="GetStartupInfoW") returned 0x75ea5320 [0065.506] GetStartupInfoW (in: lpStartupInfo=0x2930048 | out: lpStartupInfo=0x2930048*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0065.511] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x19fe2c*=0x0, ZeroBits=0x0, RegionSize=0x19fe28*=0x1d2c, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x19fe2c*=0x580000, RegionSize=0x19fe28*=0x2000) returned 0x0 [0066.305] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x400000, dwSize=0x12000, flNewProtect=0x4, lpflOldProtect=0x2930c00 | out: lpflOldProtect=0x2930c00*=0x2) returned 1 [0067.572] SetErrorMode (uMode=0x8001) returned 0x0 [0067.572] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0067.575] SetErrorMode (uMode=0x0) returned 0x8001 [0067.575] GetProcAddress (hModule=0x74500000, lpProcName="WNetEnumResourceW") returned 0x74502410 [0067.575] SetErrorMode (uMode=0x8001) returned 0x0 [0067.575] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0067.575] SetErrorMode (uMode=0x0) returned 0x8001 [0067.575] GetProcAddress (hModule=0x74500000, lpProcName="WNetUseConnectionW") returned 0x7450a790 [0067.575] SetErrorMode (uMode=0x8001) returned 0x0 [0067.575] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0067.575] SetErrorMode (uMode=0x0) returned 0x8001 [0067.575] GetProcAddress (hModule=0x74500000, lpProcName="WNetOpenEnumW") returned 0x74502790 [0067.576] SetErrorMode (uMode=0x8001) returned 0x0 [0067.576] LoadLibraryA (lpLibFileName="MPR.dll") returned 0x74500000 [0067.576] SetErrorMode (uMode=0x0) returned 0x8001 [0067.576] GetProcAddress (hModule=0x74500000, lpProcName="WNetCloseEnum") returned 0x74502640 [0067.576] SetErrorMode (uMode=0x8001) returned 0x0 [0067.576] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.578] SetErrorMode (uMode=0x0) returned 0x8001 [0067.578] GetProcAddress (hModule=0x746a0000, lpProcName=0xa) returned 0x746afa10 [0067.578] SetErrorMode (uMode=0x8001) returned 0x0 [0067.578] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.578] SetErrorMode (uMode=0x0) returned 0x8001 [0067.578] GetProcAddress (hModule=0x746a0000, lpProcName=0x4) returned 0x746a5410 [0067.578] SetErrorMode (uMode=0x8001) returned 0x0 [0067.578] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.578] SetErrorMode (uMode=0x0) returned 0x8001 [0067.578] GetProcAddress (hModule=0x746a0000, lpProcName=0xe) returned 0x746a49d0 [0067.579] SetErrorMode (uMode=0x8001) returned 0x0 [0067.579] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.579] SetErrorMode (uMode=0x0) returned 0x8001 [0067.579] GetProcAddress (hModule=0x746a0000, lpProcName=0x12) returned 0x746a4ea0 [0067.579] SetErrorMode (uMode=0x8001) returned 0x0 [0067.579] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.579] SetErrorMode (uMode=0x0) returned 0x8001 [0067.579] GetProcAddress (hModule=0x746a0000, lpProcName=0x5) returned 0x746b43d0 [0067.579] SetErrorMode (uMode=0x8001) returned 0x0 [0067.579] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.579] SetErrorMode (uMode=0x0) returned 0x8001 [0067.579] GetProcAddress (hModule=0x746a0000, lpProcName=0x9) returned 0x746b8ff0 [0067.579] SetErrorMode (uMode=0x8001) returned 0x0 [0067.579] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.579] SetErrorMode (uMode=0x0) returned 0x8001 [0067.579] GetProcAddress (hModule=0x746a0000, lpProcName=0x10) returned 0x746b0c50 [0067.579] SetErrorMode (uMode=0x8001) returned 0x0 [0067.579] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.580] SetErrorMode (uMode=0x0) returned 0x8001 [0067.580] GetProcAddress (hModule=0x746a0000, lpProcName=0x17) returned 0x746b4510 [0067.580] SetErrorMode (uMode=0x8001) returned 0x0 [0067.580] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.580] SetErrorMode (uMode=0x0) returned 0x8001 [0067.580] GetProcAddress (hModule=0x746a0000, lpProcName=0x3) returned 0x746b0910 [0067.580] SetErrorMode (uMode=0x8001) returned 0x0 [0067.580] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.580] SetErrorMode (uMode=0x0) returned 0x8001 [0067.580] GetProcAddress (hModule=0x746a0000, lpProcName=0x7) returned 0x746b3b30 [0067.580] SetErrorMode (uMode=0x8001) returned 0x0 [0067.580] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.580] SetErrorMode (uMode=0x0) returned 0x8001 [0067.580] GetProcAddress (hModule=0x746a0000, lpProcName="WSAAddressToStringW") returned 0x746b45d0 [0067.580] SetErrorMode (uMode=0x8001) returned 0x0 [0067.580] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.580] SetErrorMode (uMode=0x0) returned 0x8001 [0067.581] GetProcAddress (hModule=0x746a0000, lpProcName=0x73) returned 0x746a5b40 [0067.581] SetErrorMode (uMode=0x8001) returned 0x0 [0067.581] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.581] SetErrorMode (uMode=0x0) returned 0x8001 [0067.581] GetProcAddress (hModule=0x746a0000, lpProcName=0x8) returned 0x746a49d0 [0067.581] SetErrorMode (uMode=0x8001) returned 0x0 [0067.581] LoadLibraryA (lpLibFileName="WS2_32.dll") returned 0x746a0000 [0067.581] SetErrorMode (uMode=0x0) returned 0x8001 [0067.581] GetProcAddress (hModule=0x746a0000, lpProcName=0x6f) returned 0x746b8fe0 [0067.581] SetErrorMode (uMode=0x8001) returned 0x0 [0067.581] LoadLibraryA (lpLibFileName="IPHLPAPI.DLL") returned 0x744d0000 [0067.583] SetErrorMode (uMode=0x0) returned 0x8001 [0067.583] GetProcAddress (hModule=0x744d0000, lpProcName="GetIpAddrTable") returned 0x744ef960 [0067.583] SetErrorMode (uMode=0x8001) returned 0x0 [0067.583] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.583] SetErrorMode (uMode=0x0) returned 0x8001 [0067.583] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0067.584] SetErrorMode (uMode=0x8001) returned 0x0 [0067.584] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.584] SetErrorMode (uMode=0x0) returned 0x8001 [0067.584] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0067.584] SetErrorMode (uMode=0x8001) returned 0x0 [0067.584] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.584] SetErrorMode (uMode=0x0) returned 0x8001 [0067.584] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0067.584] SetErrorMode (uMode=0x8001) returned 0x0 [0067.584] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.584] SetErrorMode (uMode=0x0) returned 0x8001 [0067.584] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0067.584] SetErrorMode (uMode=0x8001) returned 0x0 [0067.584] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.584] SetErrorMode (uMode=0x0) returned 0x8001 [0067.584] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0067.584] SetErrorMode (uMode=0x8001) returned 0x0 [0067.584] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.585] SetErrorMode (uMode=0x0) returned 0x8001 [0067.585] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0067.585] SetErrorMode (uMode=0x8001) returned 0x0 [0067.585] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.585] SetErrorMode (uMode=0x0) returned 0x8001 [0067.585] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0067.585] SetErrorMode (uMode=0x8001) returned 0x0 [0067.585] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.585] SetErrorMode (uMode=0x0) returned 0x8001 [0067.585] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0067.585] SetErrorMode (uMode=0x8001) returned 0x0 [0067.585] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.585] SetErrorMode (uMode=0x0) returned 0x8001 [0067.585] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0067.585] SetErrorMode (uMode=0x8001) returned 0x0 [0067.585] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.585] SetErrorMode (uMode=0x0) returned 0x8001 [0067.586] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0067.586] SetErrorMode (uMode=0x8001) returned 0x0 [0067.586] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.586] SetErrorMode (uMode=0x0) returned 0x8001 [0067.586] GetProcAddress (hModule=0x75e90000, lpProcName="SetEvent") returned 0x75efec50 [0067.586] SetErrorMode (uMode=0x8001) returned 0x0 [0067.586] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.586] SetErrorMode (uMode=0x0) returned 0x8001 [0067.586] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0067.586] SetErrorMode (uMode=0x8001) returned 0x0 [0067.586] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.587] SetErrorMode (uMode=0x0) returned 0x8001 [0067.587] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0067.587] SetErrorMode (uMode=0x8001) returned 0x0 [0067.587] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.587] SetErrorMode (uMode=0x0) returned 0x8001 [0067.587] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0067.587] SetErrorMode (uMode=0x8001) returned 0x0 [0067.587] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.587] SetErrorMode (uMode=0x0) returned 0x8001 [0067.587] GetProcAddress (hModule=0x75e90000, lpProcName="CopyFileW") returned 0x75eff3b0 [0067.587] SetErrorMode (uMode=0x8001) returned 0x0 [0067.587] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.587] SetErrorMode (uMode=0x0) returned 0x8001 [0067.587] GetProcAddress (hModule=0x75e90000, lpProcName="CreateEventW") returned 0x75efeb30 [0067.587] SetErrorMode (uMode=0x8001) returned 0x0 [0067.587] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.588] SetErrorMode (uMode=0x0) returned 0x8001 [0067.588] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0067.588] SetErrorMode (uMode=0x8001) returned 0x0 [0067.588] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.588] SetErrorMode (uMode=0x0) returned 0x8001 [0067.588] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0067.588] SetErrorMode (uMode=0x8001) returned 0x0 [0067.588] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.588] SetErrorMode (uMode=0x0) returned 0x8001 [0067.588] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0067.588] SetErrorMode (uMode=0x8001) returned 0x0 [0067.589] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.589] SetErrorMode (uMode=0x0) returned 0x8001 [0067.589] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0067.589] SetErrorMode (uMode=0x8001) returned 0x0 [0067.589] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.590] SetErrorMode (uMode=0x0) returned 0x8001 [0067.590] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0067.590] SetErrorMode (uMode=0x8001) returned 0x0 [0067.590] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.591] SetErrorMode (uMode=0x0) returned 0x8001 [0067.591] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0067.591] SetErrorMode (uMode=0x8001) returned 0x0 [0067.591] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.591] SetErrorMode (uMode=0x0) returned 0x8001 [0067.591] GetProcAddress (hModule=0x75e90000, lpProcName="ResetEvent") returned 0x75efec40 [0067.591] SetErrorMode (uMode=0x8001) returned 0x0 [0067.591] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.591] SetErrorMode (uMode=0x0) returned 0x8001 [0067.591] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0067.591] SetErrorMode (uMode=0x8001) returned 0x0 [0067.591] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.591] SetErrorMode (uMode=0x0) returned 0x8001 [0067.591] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0067.591] SetErrorMode (uMode=0x8001) returned 0x0 [0067.592] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.592] SetErrorMode (uMode=0x0) returned 0x8001 [0067.592] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0067.592] SetErrorMode (uMode=0x8001) returned 0x0 [0067.592] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.592] SetErrorMode (uMode=0x0) returned 0x8001 [0067.592] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0067.592] SetErrorMode (uMode=0x8001) returned 0x0 [0067.592] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.592] SetErrorMode (uMode=0x0) returned 0x8001 [0067.592] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0067.592] SetErrorMode (uMode=0x8001) returned 0x0 [0067.592] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.592] SetErrorMode (uMode=0x0) returned 0x8001 [0067.592] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0067.592] SetErrorMode (uMode=0x8001) returned 0x0 [0067.592] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.593] SetErrorMode (uMode=0x0) returned 0x8001 [0067.593] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0067.593] SetErrorMode (uMode=0x8001) returned 0x0 [0067.593] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.593] SetErrorMode (uMode=0x0) returned 0x8001 [0067.593] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocaleInfoW") returned 0x75ea5040 [0067.593] SetErrorMode (uMode=0x8001) returned 0x0 [0067.593] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.593] SetErrorMode (uMode=0x0) returned 0x8001 [0067.593] GetProcAddress (hModule=0x75e90000, lpProcName="ReadProcessMemory") returned 0x75ea5e30 [0067.593] SetErrorMode (uMode=0x8001) returned 0x0 [0067.593] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.593] SetErrorMode (uMode=0x0) returned 0x8001 [0067.593] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0067.593] SetErrorMode (uMode=0x8001) returned 0x0 [0067.593] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.593] SetErrorMode (uMode=0x0) returned 0x8001 [0067.594] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0067.594] SetErrorMode (uMode=0x8001) returned 0x0 [0067.594] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.594] SetErrorMode (uMode=0x0) returned 0x8001 [0067.594] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0067.594] SetErrorMode (uMode=0x8001) returned 0x0 [0067.594] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.594] SetErrorMode (uMode=0x0) returned 0x8001 [0067.594] GetProcAddress (hModule=0x75e90000, lpProcName="FlushFileBuffers") returned 0x75efee70 [0067.594] SetErrorMode (uMode=0x8001) returned 0x0 [0067.594] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.594] SetErrorMode (uMode=0x0) returned 0x8001 [0067.594] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0067.594] SetErrorMode (uMode=0x8001) returned 0x0 [0067.594] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.594] SetErrorMode (uMode=0x0) returned 0x8001 [0067.595] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0067.595] SetErrorMode (uMode=0x8001) returned 0x0 [0067.595] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.595] SetErrorMode (uMode=0x0) returned 0x8001 [0067.595] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThreadId") returned 0x75ea8820 [0067.595] SetErrorMode (uMode=0x8001) returned 0x0 [0067.595] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.595] SetErrorMode (uMode=0x0) returned 0x8001 [0067.595] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0067.595] SetErrorMode (uMode=0x8001) returned 0x0 [0067.595] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.595] SetErrorMode (uMode=0x0) returned 0x8001 [0067.595] GetProcAddress (hModule=0x75e90000, lpProcName="GetExitCodeThread") returned 0x75ea4ff0 [0067.595] SetErrorMode (uMode=0x8001) returned 0x0 [0067.595] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.595] SetErrorMode (uMode=0x0) returned 0x8001 [0067.596] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0067.596] SetErrorMode (uMode=0x8001) returned 0x0 [0067.596] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.596] SetErrorMode (uMode=0x0) returned 0x8001 [0067.596] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0067.596] SetErrorMode (uMode=0x8001) returned 0x0 [0067.596] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.596] SetErrorMode (uMode=0x0) returned 0x8001 [0067.596] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleA") returned 0x75ea50b0 [0067.596] SetErrorMode (uMode=0x8001) returned 0x0 [0067.596] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.596] SetErrorMode (uMode=0x0) returned 0x8001 [0067.596] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0067.596] SetErrorMode (uMode=0x8001) returned 0x0 [0067.596] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.596] SetErrorMode (uMode=0x0) returned 0x8001 [0067.596] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0067.596] SetErrorMode (uMode=0x8001) returned 0x0 [0067.597] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.597] SetErrorMode (uMode=0x0) returned 0x8001 [0067.597] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0067.597] SetErrorMode (uMode=0x8001) returned 0x0 [0067.597] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.597] SetErrorMode (uMode=0x0) returned 0x8001 [0067.597] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0067.597] SetErrorMode (uMode=0x8001) returned 0x0 [0067.597] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.597] SetErrorMode (uMode=0x0) returned 0x8001 [0067.597] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0067.597] SetErrorMode (uMode=0x8001) returned 0x0 [0067.597] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.597] SetErrorMode (uMode=0x0) returned 0x8001 [0067.597] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0067.597] SetErrorMode (uMode=0x8001) returned 0x0 [0067.597] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.598] SetErrorMode (uMode=0x0) returned 0x8001 [0067.598] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0067.598] SetErrorMode (uMode=0x8001) returned 0x0 [0067.598] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.598] SetErrorMode (uMode=0x0) returned 0x8001 [0067.598] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0067.598] SetErrorMode (uMode=0x8001) returned 0x0 [0067.598] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.598] SetErrorMode (uMode=0x0) returned 0x8001 [0067.598] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0067.598] SetErrorMode (uMode=0x8001) returned 0x0 [0067.598] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.598] SetErrorMode (uMode=0x0) returned 0x8001 [0067.598] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0067.598] SetErrorMode (uMode=0x8001) returned 0x0 [0067.598] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.599] SetErrorMode (uMode=0x0) returned 0x8001 [0067.599] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0067.599] SetErrorMode (uMode=0x8001) returned 0x0 [0067.599] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.599] SetErrorMode (uMode=0x0) returned 0x8001 [0067.599] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0067.599] SetErrorMode (uMode=0x8001) returned 0x0 [0067.599] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.599] SetErrorMode (uMode=0x0) returned 0x8001 [0067.599] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0067.599] SetErrorMode (uMode=0x8001) returned 0x0 [0067.599] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.599] SetErrorMode (uMode=0x0) returned 0x8001 [0067.599] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0067.599] SetErrorMode (uMode=0x8001) returned 0x0 [0067.599] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.600] SetErrorMode (uMode=0x0) returned 0x8001 [0067.600] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0067.600] SetErrorMode (uMode=0x8001) returned 0x0 [0067.600] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.600] SetErrorMode (uMode=0x0) returned 0x8001 [0067.600] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0067.600] SetErrorMode (uMode=0x8001) returned 0x0 [0067.600] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.600] SetErrorMode (uMode=0x0) returned 0x8001 [0067.600] GetProcAddress (hModule=0x75e90000, lpProcName="GetLocalTime") returned 0x75ea5060 [0067.600] SetErrorMode (uMode=0x8001) returned 0x0 [0067.600] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75e90000 [0067.600] SetErrorMode (uMode=0x0) returned 0x8001 [0067.600] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0067.600] SetErrorMode (uMode=0x8001) returned 0x0 [0067.600] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74b70000 [0067.600] SetErrorMode (uMode=0x0) returned 0x8001 [0067.601] GetProcAddress (hModule=0x74b70000, lpProcName="GetShellWindow") returned 0x74ba1150 [0067.601] SetErrorMode (uMode=0x8001) returned 0x0 [0067.601] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74b70000 [0067.601] SetErrorMode (uMode=0x0) returned 0x8001 [0067.601] GetProcAddress (hModule=0x74b70000, lpProcName="GetWindowThreadProcessId") returned 0x74b9eb60 [0067.601] SetErrorMode (uMode=0x8001) returned 0x0 [0067.601] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.601] SetErrorMode (uMode=0x0) returned 0x8001 [0067.601] GetProcAddress (hModule=0x761b0000, lpProcName="DuplicateTokenEx") returned 0x761d0370 [0067.601] SetErrorMode (uMode=0x8001) returned 0x0 [0067.601] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.601] SetErrorMode (uMode=0x0) returned 0x8001 [0067.601] GetProcAddress (hModule=0x761b0000, lpProcName="LookupAccountSidW") returned 0x761cf100 [0067.601] SetErrorMode (uMode=0x8001) returned 0x0 [0067.796] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.796] SetErrorMode (uMode=0x0) returned 0x8001 [0067.797] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0067.797] SetErrorMode (uMode=0x8001) returned 0x0 [0067.797] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.797] SetErrorMode (uMode=0x0) returned 0x8001 [0067.797] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0067.797] SetErrorMode (uMode=0x8001) returned 0x0 [0067.797] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.797] SetErrorMode (uMode=0x0) returned 0x8001 [0067.797] GetProcAddress (hModule=0x761b0000, lpProcName="EqualSid") returned 0x761cffe0 [0067.797] SetErrorMode (uMode=0x8001) returned 0x0 [0067.797] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.797] SetErrorMode (uMode=0x0) returned 0x8001 [0067.797] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0067.797] SetErrorMode (uMode=0x8001) returned 0x0 [0067.797] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.797] SetErrorMode (uMode=0x0) returned 0x8001 [0067.798] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0067.798] SetErrorMode (uMode=0x8001) returned 0x0 [0067.798] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.798] SetErrorMode (uMode=0x0) returned 0x8001 [0067.798] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0067.798] SetErrorMode (uMode=0x8001) returned 0x0 [0067.798] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.798] SetErrorMode (uMode=0x0) returned 0x8001 [0067.798] GetProcAddress (hModule=0x761b0000, lpProcName="FreeSid") returned 0x761cfa80 [0067.798] SetErrorMode (uMode=0x8001) returned 0x0 [0067.798] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.798] SetErrorMode (uMode=0x0) returned 0x8001 [0067.798] GetProcAddress (hModule=0x761b0000, lpProcName="AllocateAndInitializeSid") returned 0x761cf440 [0067.798] SetErrorMode (uMode=0x8001) returned 0x0 [0067.798] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x761b0000 [0067.798] SetErrorMode (uMode=0x0) returned 0x8001 [0067.799] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0067.799] SetErrorMode (uMode=0x8001) returned 0x0 [0067.799] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x76480000 [0067.799] SetErrorMode (uMode=0x0) returned 0x8001 [0067.799] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0067.799] SetErrorMode (uMode=0x8001) returned 0x0 [0067.799] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77920000 [0067.799] SetErrorMode (uMode=0x0) returned 0x8001 [0067.799] GetProcAddress (hModule=0x77920000, lpProcName="CoGetObject") returned 0x77953cc0 [0067.799] SetErrorMode (uMode=0x8001) returned 0x0 [0067.799] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77920000 [0067.799] SetErrorMode (uMode=0x0) returned 0x8001 [0067.799] GetProcAddress (hModule=0x77920000, lpProcName="CoInitializeEx") returned 0x75d32590 [0067.799] SetErrorMode (uMode=0x8001) returned 0x0 [0067.800] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x77920000 [0067.800] SetErrorMode (uMode=0x0) returned 0x8001 [0067.800] GetProcAddress (hModule=0x77920000, lpProcName="CoUninitialize") returned 0x75d322b0 [0067.804] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0067.805] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x401000, dwSize=0x7bb8, flNewProtect=0x20, lpflOldProtect=0x2930c00 | out: lpflOldProtect=0x2930c00*=0x4) returned 1 [0067.809] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0067.809] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x409000, dwSize=0xc4a, flNewProtect=0x4, lpflOldProtect=0x2930c00 | out: lpflOldProtect=0x2930c00*=0x4) returned 1 [0067.814] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0067.814] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x40a000, dwSize=0x2719, flNewProtect=0x4, lpflOldProtect=0x2930c00 | out: lpflOldProtect=0x2930c00*=0x4) returned 1 [0067.819] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0067.819] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x40d000, dwSize=0x558, flNewProtect=0x4, lpflOldProtect=0x2930c00 | out: lpflOldProtect=0x2930c00*=0x4) returned 1 [0067.824] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0067.824] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x40e000, dwSize=0x35cc, flNewProtect=0x4, lpflOldProtect=0x2930c00 | out: lpflOldProtect=0x2930c00*=0x4) returned 1 [0067.829] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0067.829] VirtualProtectEx (in: hProcess=0xffffffff, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x2930c00 | out: lpflOldProtect=0x2930c00*=0x4) returned 1 [0067.829] SetErrorMode (uMode=0x8001) returned 0x0 [0067.829] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0067.829] SetErrorMode (uMode=0x0) returned 0x8001 [0067.829] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0067.829] SetErrorMode (uMode=0x8001) returned 0x0 [0067.830] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0067.830] SetErrorMode (uMode=0x0) returned 0x8001 [0067.830] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentThread") returned 0x75ea8810 [0067.830] SetErrorMode (uMode=0x8001) returned 0x0 [0067.830] LoadLibraryA (lpLibFileName="kernel32") returned 0x75e90000 [0067.830] SetErrorMode (uMode=0x0) returned 0x8001 [0067.830] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateThread") returned 0x75ea6800 [0067.835] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0067.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402518, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0067.840] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0068.062] NtSetInformationThread (ThreadHandle=0x1f8, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0068.062] GetCurrentThread () returned 0xfffffffe [0068.066] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x2934004 | out: Context=0x2934004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0068.066] TerminateThread (hThread=0xfffffffe, dwExitCode=0x0) Thread: id = 9 os_tid = 0xf08 Thread: id = 21 os_tid = 0x83c [0068.029] GetCurrentThreadId () returned 0x83c [0068.038] GetProcessHeap () returned 0x760000 [0068.043] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x30) returned 0x77dc40 [0068.043] GetProcessHeap () returned 0x760000 [0068.048] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x33c0) returned 0x77ed48 [0068.048] GetProcessHeap () returned 0x760000 [0068.053] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x204) returned 0x782110 [0068.053] GetProcessHeap () returned 0x760000 [0068.057] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10) returned 0x76a718 [0068.241] GetTickCount () returned 0x115176c [0068.241] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x283fde8 | out: lpWSAData=0x283fde8) returned 0 [0068.245] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x283fdc8, cchData=32 | out: lpLCData="\x03") returned 16 [0068.245] GetProcessHeap () returned 0x760000 [0068.249] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1c) returned 0x77e290 [0068.250] GetProcessHeap () returned 0x760000 [0068.254] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1c) returned 0x77e2b8 [0068.254] GetVersion () returned 0x23f00206 [0068.254] GetCurrentProcess () returned 0xffffffff [0068.254] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x283fd3c | out: TokenHandle=0x283fd3c*=0x208) returned 1 [0068.254] GetTokenInformation (in: TokenHandle=0x208, TokenInformationClass=0x14, TokenInformation=0x283fd34, TokenInformationLength=0x4, ReturnLength=0x283fd38 | out: TokenInformation=0x283fd34, ReturnLength=0x283fd38) returned 1 [0068.254] CloseHandle (hObject=0x208) returned 1 [0068.254] GetProcessHeap () returned 0x760000 [0068.259] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e268 [0068.259] GetProcessHeap () returned 0x760000 [0068.264] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e150 [0068.264] GetProcessHeap () returned 0x760000 [0068.268] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e358 [0068.268] GetProcessHeap () returned 0x760000 [0068.273] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x768aa8 [0068.273] GetProcessHeap () returned 0x760000 [0068.273] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0068.273] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x77e150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.273] GetProcessHeap () returned 0x760000 [0068.273] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e358 | out: hHeap=0x760000) returned 1 [0068.273] GetProcessHeap () returned 0x760000 [0068.273] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e268 | out: hHeap=0x760000) returned 1 [0068.273] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fcdc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fcdc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.368] GetProcessHeap () returned 0x760000 [0068.368] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e150 | out: hHeap=0x760000) returned 1 [0068.368] GetProcessHeap () returned 0x760000 [0068.373] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x771d08 [0068.373] GetProcessHeap () returned 0x760000 [0068.377] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x772410 [0068.377] GetProcessHeap () returned 0x760000 [0068.382] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x772410, Size=0x72) returned 0x768aa8 [0068.382] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0068.382] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x208 [0068.382] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x0 [0068.382] GetProcessHeap () returned 0x760000 [0068.382] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771d08 | out: hHeap=0x760000) returned 1 [0068.382] GetProcessHeap () returned 0x760000 [0068.382] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0068.382] GetProcessHeap () returned 0x760000 [0068.387] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e100 [0068.387] GetProcessHeap () returned 0x760000 [0068.391] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e268 [0068.391] GetProcessHeap () returned 0x760000 [0068.396] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e1c8 [0068.396] GetProcessHeap () returned 0x760000 [0068.400] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x768aa8 [0068.619] GetProcessHeap () returned 0x760000 [0068.619] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0068.619] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x77e268, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.619] GetProcessHeap () returned 0x760000 [0068.619] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e1c8 | out: hHeap=0x760000) returned 1 [0068.619] GetProcessHeap () returned 0x760000 [0068.619] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e100 | out: hHeap=0x760000) returned 1 [0068.619] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fcc4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fcc4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.619] GetProcessHeap () returned 0x760000 [0068.619] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e268 | out: hHeap=0x760000) returned 1 [0068.619] GetProcessHeap () returned 0x760000 [0068.624] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x771d08 [0068.624] GetProcessHeap () returned 0x760000 [0068.628] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x772218 [0068.628] GetProcessHeap () returned 0x760000 [0068.633] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x772218, Size=0x72) returned 0x768aa8 [0068.633] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x20c [0068.633] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x102 [0068.633] CloseHandle (hObject=0x20c) returned 1 [0068.634] GetProcessHeap () returned 0x760000 [0068.634] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771d08 | out: hHeap=0x760000) returned 1 [0068.634] GetProcessHeap () returned 0x760000 [0068.634] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0068.634] GetProcessHeap () returned 0x760000 [0068.638] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x60) returned 0x768aa8 [0068.638] GetProcessHeap () returned 0x760000 [0068.643] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e358 [0068.643] GetProcessHeap () returned 0x760000 [0068.647] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e330 [0068.647] GetProcessHeap () returned 0x760000 [0068.652] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e2e0 [0068.890] GetProcessHeap () returned 0x760000 [0068.894] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x769090 [0068.894] GetProcessHeap () returned 0x760000 [0068.894] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x769090 | out: hHeap=0x760000) returned 1 [0068.894] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x77e330, nSize=0xf | out: lpDst="") returned 0x1e [0068.895] GetProcessHeap () returned 0x760000 [0068.895] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e2e0 | out: hHeap=0x760000) returned 1 [0068.895] GetProcessHeap () returned 0x760000 [0068.899] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x77e330, Size=0x3a) returned 0x772410 [0068.899] GetProcessHeap () returned 0x760000 [0068.904] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x3a) returned 0x771eb8 [0068.904] GetProcessHeap () returned 0x760000 [0068.908] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x769090 [0068.908] GetProcessHeap () returned 0x760000 [0068.908] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x769090 | out: hHeap=0x760000) returned 1 [0068.908] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x772410, nSize=0x1d | out: lpDst="") returned 0x1e [0068.909] GetProcessHeap () returned 0x760000 [0068.909] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771eb8 | out: hHeap=0x760000) returned 1 [0068.909] GetProcessHeap () returned 0x760000 [0068.913] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x772410, Size=0x72) returned 0x769090 [0068.913] GetProcessHeap () returned 0x760000 [0068.918] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x72) returned 0x77a790 [0068.918] GetProcessHeap () returned 0x760000 [0068.922] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x77a810 [0068.922] GetProcessHeap () returned 0x760000 [0068.922] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77a810 | out: hHeap=0x760000) returned 1 [0068.922] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x769090, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0068.922] GetProcessHeap () returned 0x760000 [0068.922] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77a790 | out: hHeap=0x760000) returned 1 [0068.922] GetProcessHeap () returned 0x760000 [0068.922] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e358 | out: hHeap=0x760000) returned 1 [0068.922] GetProcessHeap () returned 0x760000 [0068.927] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x771d50 [0068.927] GetProcessHeap () returned 0x760000 [0068.931] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3e) returned 0x772140 [0069.119] GetProcessHeap () returned 0x760000 [0069.124] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x3e) returned 0x772188 [0069.124] GetProcessHeap () returned 0x760000 [0069.128] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x77a790 [0069.128] GetProcessHeap () returned 0x760000 [0069.133] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x10) returned 0x76a730 [0069.133] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc1c | out: phkResult=0x283fc1c*=0x210) returned 0x0 [0069.133] RegQueryValueExW (in: hKey=0x210, lpValueName="Startup", lpReserved=0x0, lpType=0x283fc18, lpData=0x772188, lpcbData=0x283fc20*=0x3e | out: lpType=0x283fc18*=0x2, lpData=0x772188*=0x0, lpcbData=0x283fc20*=0x98) returned 0xea [0069.133] RegCloseKey (hKey=0x210) returned 0x0 [0069.133] GetProcessHeap () returned 0x760000 [0069.133] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a730 | out: hHeap=0x760000) returned 1 [0069.133] GetProcessHeap () returned 0x760000 [0069.133] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77a790 | out: hHeap=0x760000) returned 1 [0069.133] GetProcessHeap () returned 0x760000 [0069.133] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x772188 | out: hHeap=0x760000) returned 1 [0069.133] GetProcessHeap () returned 0x760000 [0069.138] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x772140, Size=0x7a) returned 0x77a790 [0069.138] GetProcessHeap () returned 0x760000 [0069.143] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x7a) returned 0x77a818 [0069.143] GetProcessHeap () returned 0x760000 [0069.147] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x76a270 [0069.147] GetProcessHeap () returned 0x760000 [0069.152] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x10) returned 0x76a730 [0069.452] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc1c | out: phkResult=0x283fc1c*=0x210) returned 0x0 [0069.452] RegQueryValueExW (in: hKey=0x210, lpValueName="Startup", lpReserved=0x0, lpType=0x283fc18, lpData=0x77a818, lpcbData=0x283fc20*=0x7a | out: lpType=0x283fc18*=0x2, lpData=0x77a818*=0x70, lpcbData=0x283fc20*=0x98) returned 0xea [0069.452] RegCloseKey (hKey=0x210) returned 0x0 [0069.452] GetProcessHeap () returned 0x760000 [0069.452] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a730 | out: hHeap=0x760000) returned 1 [0069.452] GetProcessHeap () returned 0x760000 [0069.452] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a270 | out: hHeap=0x760000) returned 1 [0069.452] GetProcessHeap () returned 0x760000 [0069.452] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77a818 | out: hHeap=0x760000) returned 1 [0069.452] GetProcessHeap () returned 0x760000 [0069.457] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x77a790, Size=0xf2) returned 0x77a790 [0069.457] GetProcessHeap () returned 0x760000 [0069.462] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0xf2) returned 0x76a270 [0069.463] GetProcessHeap () returned 0x760000 [0069.468] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x786e18 [0069.468] GetProcessHeap () returned 0x760000 [0069.472] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x10) returned 0x76a730 [0069.472] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc1c | out: phkResult=0x283fc1c*=0x210) returned 0x0 [0069.472] RegQueryValueExW (in: hKey=0x210, lpValueName="Startup", lpReserved=0x0, lpType=0x283fc18, lpData=0x76a270, lpcbData=0x283fc20*=0xf2 | out: lpType=0x283fc18*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x283fc20*=0x98) returned 0x0 [0069.472] RegCloseKey (hKey=0x210) returned 0x0 [0069.472] GetProcessHeap () returned 0x760000 [0069.472] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a730 | out: hHeap=0x760000) returned 1 [0069.472] GetProcessHeap () returned 0x760000 [0069.477] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e1a0 [0069.477] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc1c | out: phkResult=0x283fc1c*=0x210) returned 0x0 [0069.477] RegQueryValueExW (in: hKey=0x210, lpValueName="Common Startup", lpReserved=0x0, lpType=0x283fc18, lpData=0x76a308, lpcbData=0x283fc20*=0x5a | out: lpType=0x283fc18*=0x0, lpData=0x76a308*=0x18, lpcbData=0x283fc20*=0x5a) returned 0x2 [0069.477] RegCloseKey (hKey=0x210) returned 0x0 [0069.477] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc30 | out: phkResult=0x283fc30*=0x210) returned 0x0 [0069.477] RegQueryValueExW (in: hKey=0x210, lpValueName="Common Startup", lpReserved=0x0, lpType=0x283fc2c, lpData=0x76a308, lpcbData=0x283fc34*=0x5a | out: lpType=0x283fc2c*=0x2, lpData=0x76a308*=0x18, lpcbData=0x283fc34*=0x78) returned 0xea [0069.477] RegCloseKey (hKey=0x210) returned 0x0 [0069.477] GetProcessHeap () returned 0x760000 [0069.477] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e1a0 | out: hHeap=0x760000) returned 1 [0069.478] GetProcessHeap () returned 0x760000 [0069.478] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x786e18 | out: hHeap=0x760000) returned 1 [0069.478] GetProcessHeap () returned 0x760000 [0069.478] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a270 | out: hHeap=0x760000) returned 1 [0069.478] GetProcessHeap () returned 0x760000 [0069.482] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x77a790, Size=0x1e2) returned 0x786e18 [0069.482] GetProcessHeap () returned 0x760000 [0069.487] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e2) returned 0x787008 [0069.487] GetProcessHeap () returned 0x760000 [0069.492] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x77a790 [0069.492] GetProcessHeap () returned 0x760000 [0069.496] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x10) returned 0x76a730 [0069.684] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc1c | out: phkResult=0x283fc1c*=0x210) returned 0x0 [0069.684] RegQueryValueExW (in: hKey=0x210, lpValueName="Startup", lpReserved=0x0, lpType=0x283fc18, lpData=0x787008, lpcbData=0x283fc20*=0x1e2 | out: lpType=0x283fc18*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x283fc20*=0x98) returned 0x0 [0069.684] RegCloseKey (hKey=0x210) returned 0x0 [0069.684] GetProcessHeap () returned 0x760000 [0069.684] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a730 | out: hHeap=0x760000) returned 1 [0069.684] GetProcessHeap () returned 0x760000 [0069.688] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e380 [0069.689] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc1c | out: phkResult=0x283fc1c*=0x210) returned 0x0 [0069.689] RegQueryValueExW (in: hKey=0x210, lpValueName="Common Startup", lpReserved=0x0, lpType=0x283fc18, lpData=0x7870a0, lpcbData=0x283fc20*=0x14a | out: lpType=0x283fc18*=0x0, lpData=0x7870a0*=0x0, lpcbData=0x283fc20*=0x14a) returned 0x2 [0069.689] RegCloseKey (hKey=0x210) returned 0x0 [0069.689] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x283fc30 | out: phkResult=0x283fc30*=0x210) returned 0x0 [0069.689] RegQueryValueExW (in: hKey=0x210, lpValueName="Common Startup", lpReserved=0x0, lpType=0x283fc2c, lpData=0x7870a0, lpcbData=0x283fc34*=0x14a | out: lpType=0x283fc2c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x283fc34*=0x78) returned 0x0 [0069.689] RegCloseKey (hKey=0x210) returned 0x0 [0069.689] GetProcessHeap () returned 0x760000 [0069.689] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e380 | out: hHeap=0x760000) returned 1 [0069.689] GetProcessHeap () returned 0x760000 [0069.689] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77a790 | out: hHeap=0x760000) returned 1 [0069.689] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x786e18, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0069.689] GetProcessHeap () returned 0x760000 [0069.689] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787008 | out: hHeap=0x760000) returned 1 [0069.689] GetProcessHeap () returned 0x760000 [0069.689] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771d50 | out: hHeap=0x760000) returned 1 [0069.689] GetProcessHeap () returned 0x760000 [0069.694] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787008 [0069.694] GetProcessHeap () returned 0x760000 [0069.698] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787220 [0069.698] GetProcessHeap () returned 0x760000 [0069.703] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787438 [0069.703] GetProcessHeap () returned 0x760000 [0069.707] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787650 [0069.707] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x787008, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0069.707] GetProcessHeap () returned 0x760000 [0069.712] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787868 [0069.712] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x787868, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0069.712] GetProcessHeap () returned 0x760000 [0069.712] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787868 | out: hHeap=0x760000) returned 1 [0069.712] GetProcessHeap () returned 0x760000 [0069.716] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787868 [0069.716] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x787868, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0069.716] GetProcessHeap () returned 0x760000 [0069.716] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787868 | out: hHeap=0x760000) returned 1 [0069.716] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\gasas.exe"), bFailIfExists=0) returned 1 [0069.946] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x283fd18 | out: phkResult=0x283fd18*=0x210) returned 0x0 [0069.946] RegSetValueExW (hKey=0x210, lpValueName="GASAS", Reserved=0x0, dwType=0x1, lpData=0x787220, cbData=0x4e) returned 0x5 [0069.946] RegCloseKey (hKey=0x210) returned 0x0 [0069.946] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x283fd14 | out: phkResult=0x283fd14*=0x210) returned 0x0 [0069.946] RegSetValueExW (in: hKey=0x210, lpValueName="GASAS", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe", cbData=0x4e | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\GASAS.exe") returned 0x0 [0069.946] RegCloseKey (hKey=0x210) returned 0x0 [0069.946] GetProcessHeap () returned 0x760000 [0069.951] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x118) returned 0x77a790 [0069.951] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\gasas.exe"), bFailIfExists=1) returned 0 [0069.952] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\GASAS.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\gasas.exe"), bFailIfExists=1) returned 0 [0069.952] GetProcessHeap () returned 0x760000 [0069.952] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77a790 | out: hHeap=0x760000) returned 1 [0069.952] GetProcessHeap () returned 0x760000 [0069.952] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787008 | out: hHeap=0x760000) returned 1 [0069.952] GetProcessHeap () returned 0x760000 [0069.952] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787220 | out: hHeap=0x760000) returned 1 [0069.952] GetProcessHeap () returned 0x760000 [0069.952] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787438 | out: hHeap=0x760000) returned 1 [0069.952] GetProcessHeap () returned 0x760000 [0069.952] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787650 | out: hHeap=0x760000) returned 1 [0069.952] GetProcessHeap () returned 0x760000 [0069.952] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0069.953] GetProcessHeap () returned 0x760000 [0069.953] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x769090 | out: hHeap=0x760000) returned 1 [0069.953] GetProcessHeap () returned 0x760000 [0069.953] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x786e18 | out: hHeap=0x760000) returned 1 [0069.953] GetProcessHeap () returned 0x760000 [0069.957] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e240 [0069.957] GetProcessHeap () returned 0x760000 [0069.961] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e3a8 [0070.289] GetProcessHeap () returned 0x760000 [0070.294] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e0d8 [0070.294] GetProcessHeap () returned 0x760000 [0070.298] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x769090 [0070.298] GetProcessHeap () returned 0x760000 [0070.298] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x769090 | out: hHeap=0x760000) returned 1 [0070.298] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x77e3a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.298] GetProcessHeap () returned 0x760000 [0070.298] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e0d8 | out: hHeap=0x760000) returned 1 [0070.298] GetProcessHeap () returned 0x760000 [0070.298] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e240 | out: hHeap=0x760000) returned 1 [0070.298] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fd34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fd34*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.298] GetProcessHeap () returned 0x760000 [0070.298] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e3a8 | out: hHeap=0x760000) returned 1 [0070.298] GetProcessHeap () returned 0x760000 [0070.303] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x28) returned 0x7713e0 [0070.303] GetProcessHeap () returned 0x760000 [0070.307] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10) returned 0x76a8f8 [0070.308] GetProcessHeap () returned 0x760000 [0070.312] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x60) returned 0x76a270 [0070.312] GetProcessHeap () returned 0x760000 [0070.316] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x5a) returned 0x769090 [0070.316] GetProcessHeap () returned 0x760000 [0070.320] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x769090, Size=0xb2) returned 0x77a790 [0070.320] GetProcessHeap () returned 0x760000 [0070.325] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10) returned 0x76a8c8 [0070.325] GetProcessHeap () returned 0x760000 [0070.329] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x180) returned 0x786e18 [0070.329] GetProcessHeap () returned 0x760000 [0070.333] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x250) returned 0x786fa0 [0070.333] GetProcessHeap () returned 0x760000 [0070.337] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x769090 [0070.594] GetProcessHeap () returned 0x760000 [0070.598] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x84) returned 0x768aa8 [0070.598] GetProcessHeap () returned 0x760000 [0070.603] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x84) returned 0x7871f8 [0070.604] GetProcessHeap () returned 0x760000 [0070.609] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787288 [0070.609] GetProcessHeap () returned 0x760000 [0070.609] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787288 | out: hHeap=0x760000) returned 1 [0070.609] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x768aa8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0070.609] GetProcessHeap () returned 0x760000 [0070.609] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7871f8 | out: hHeap=0x760000) returned 1 [0070.609] GetProcessHeap () returned 0x760000 [0070.609] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x769090 | out: hHeap=0x760000) returned 1 [0070.609] GetProcessHeap () returned 0x760000 [0070.613] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0xc0) returned 0x7871f8 [0070.614] GetProcessHeap () returned 0x760000 [0070.618] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb8) returned 0x7872c0 [0070.618] GetProcessHeap () returned 0x760000 [0070.623] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0xb8) returned 0x787380 [0070.623] GetProcessHeap () returned 0x760000 [0070.627] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x769090 [0070.627] GetProcessHeap () returned 0x760000 [0070.627] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x769090 | out: hHeap=0x760000) returned 1 [0070.627] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x7872c0, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0070.627] GetProcessHeap () returned 0x760000 [0070.627] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787380 | out: hHeap=0x760000) returned 1 [0070.627] GetProcessHeap () returned 0x760000 [0070.627] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7871f8 | out: hHeap=0x760000) returned 1 [0070.627] GetProcessHeap () returned 0x760000 [0070.632] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787380 [0070.632] GetProcessHeap () returned 0x760000 [0070.636] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787598 [0070.928] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x787598, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0070.928] GetProcessHeap () returned 0x760000 [0070.928] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787598 | out: hHeap=0x760000) returned 1 [0070.928] GetProcessHeap () returned 0x760000 [0070.932] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x174) returned 0x787598 [0070.932] GetProcessHeap () returned 0x760000 [0070.937] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x787598, Size=0x3be) returned 0x787598 [0070.937] GetProcessHeap () returned 0x760000 [0070.941] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x86) returned 0x769090 [0070.941] GetProcessHeap () returned 0x760000 [0070.946] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x769090, Size=0x9a) returned 0x769090 [0070.946] GetProcessHeap () returned 0x760000 [0070.950] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0xba) returned 0x7871f8 [0070.950] GetProcessHeap () returned 0x760000 [0070.950] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787380 | out: hHeap=0x760000) returned 1 [0070.950] GetProcessHeap () returned 0x760000 [0070.950] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x786e18 | out: hHeap=0x760000) returned 1 [0070.950] GetProcessHeap () returned 0x760000 [0070.950] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x786fa0 | out: hHeap=0x760000) returned 1 [0070.951] GetProcessHeap () returned 0x760000 [0070.951] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0070.951] GetProcessHeap () returned 0x760000 [0070.951] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7872c0 | out: hHeap=0x760000) returned 1 [0070.951] GetProcessHeap () returned 0x760000 [0070.951] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a8f8 | out: hHeap=0x760000) returned 1 [0070.951] GetProcessHeap () returned 0x760000 [0070.951] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a270 | out: hHeap=0x760000) returned 1 [0070.951] GetProcessHeap () returned 0x760000 [0070.955] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e0d8 [0070.955] GetProcessHeap () returned 0x760000 [0070.960] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e3a8 [0070.960] GetProcessHeap () returned 0x760000 [0070.964] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e100 [0070.964] GetProcessHeap () returned 0x760000 [0070.968] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x768aa8 [0071.095] GetProcessHeap () returned 0x760000 [0071.095] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0071.095] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x77e3a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0071.095] GetProcessHeap () returned 0x760000 [0071.095] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e100 | out: hHeap=0x760000) returned 1 [0071.095] GetProcessHeap () returned 0x760000 [0071.095] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e0d8 | out: hHeap=0x760000) returned 1 [0071.095] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fd34, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fd34*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0071.096] GetProcessHeap () returned 0x760000 [0071.096] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e3a8 | out: hHeap=0x760000) returned 1 [0071.096] GetProcessHeap () returned 0x760000 [0071.100] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x28) returned 0x7712f0 [0071.100] GetProcessHeap () returned 0x760000 [0071.105] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10) returned 0x76a940 [0071.105] GetProcessHeap () returned 0x760000 [0071.109] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x60) returned 0x76a270 [0071.110] GetProcessHeap () returned 0x760000 [0071.114] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x5a) returned 0x768aa8 [0071.114] GetProcessHeap () returned 0x760000 [0071.119] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x768aa8, Size=0xb2) returned 0x7872c0 [0071.119] GetProcessHeap () returned 0x760000 [0071.123] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10) returned 0x76a958 [0071.124] GetProcessHeap () returned 0x760000 [0071.128] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x180) returned 0x787380 [0071.128] GetProcessHeap () returned 0x760000 [0071.133] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x250) returned 0x786e18 [0071.133] GetProcessHeap () returned 0x760000 [0071.137] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x768aa8 [0071.137] GetProcessHeap () returned 0x760000 [0071.141] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x84) returned 0x787508 [0071.421] GetProcessHeap () returned 0x760000 [0071.426] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x84) returned 0x787070 [0071.426] GetProcessHeap () returned 0x760000 [0071.430] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787100 [0071.430] GetProcessHeap () returned 0x760000 [0071.430] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787100 | out: hHeap=0x760000) returned 1 [0071.430] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x787508, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0071.430] GetProcessHeap () returned 0x760000 [0071.430] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787070 | out: hHeap=0x760000) returned 1 [0071.430] GetProcessHeap () returned 0x760000 [0071.430] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0071.430] GetProcessHeap () returned 0x760000 [0071.435] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0xc0) returned 0x787070 [0071.435] GetProcessHeap () returned 0x760000 [0071.439] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0xb8) returned 0x787138 [0071.439] GetProcessHeap () returned 0x760000 [0071.444] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0xb8) returned 0x787960 [0071.444] GetProcessHeap () returned 0x760000 [0071.448] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x768aa8 [0071.448] GetProcessHeap () returned 0x760000 [0071.448] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x768aa8 | out: hHeap=0x760000) returned 1 [0071.448] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;", lpDst=0x787138, nSize=0x5c | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;C:\\Users\\admin\\microsoft\\windows\\caches;") returned 0x5c [0071.448] GetProcessHeap () returned 0x760000 [0071.448] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0071.449] GetProcessHeap () returned 0x760000 [0071.449] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787070 | out: hHeap=0x760000) returned 1 [0071.449] GetProcessHeap () returned 0x760000 [0071.453] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787960 [0071.593] GetProcessHeap () returned 0x760000 [0071.598] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20a) returned 0x787b78 [0071.598] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x787b78, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\GASAS.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\gasas.exe")) returned 0x21 [0071.598] GetProcessHeap () returned 0x760000 [0071.598] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787b78 | out: hHeap=0x760000) returned 1 [0071.598] GetProcessHeap () returned 0x760000 [0071.602] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x174) returned 0x787b78 [0071.602] GetProcessHeap () returned 0x760000 [0071.607] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x24e) returned 0x787cf8 [0071.608] GetProcessHeap () returned 0x760000 [0071.613] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x86) returned 0x768aa8 [0071.613] GetProcessHeap () returned 0x760000 [0071.617] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x768aa8, Size=0x9a) returned 0x768aa8 [0071.617] GetProcessHeap () returned 0x760000 [0071.622] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0xba) returned 0x787070 [0071.622] GetProcessHeap () returned 0x760000 [0071.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0071.622] GetProcessHeap () returned 0x760000 [0071.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787380 | out: hHeap=0x760000) returned 1 [0071.622] GetProcessHeap () returned 0x760000 [0071.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x786e18 | out: hHeap=0x760000) returned 1 [0071.622] GetProcessHeap () returned 0x760000 [0071.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787508 | out: hHeap=0x760000) returned 1 [0071.622] GetProcessHeap () returned 0x760000 [0071.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787138 | out: hHeap=0x760000) returned 1 [0071.622] GetProcessHeap () returned 0x760000 [0071.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a940 | out: hHeap=0x760000) returned 1 [0071.622] GetProcessHeap () returned 0x760000 [0071.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x76a270 | out: hHeap=0x760000) returned 1 [0071.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x402013, lpParameter=0x283fd60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0071.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401fab, lpParameter=0x283fd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0071.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401e4e, lpParameter=0x283fd7c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0071.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x401859, lpParameter=0x283fd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0071.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40197c, lpParameter=0x283fd70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0071.624] WaitForSingleObject (hHandle=0x23c, dwMilliseconds=0xffffffff) returned 0x0 [0072.797] WaitForMultipleObjects (nCount=0x4, lpHandles=0x283fd88*=0x210, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 22 os_tid = 0x824 [0071.879] GetCurrentThreadId () returned 0x824 [0071.888] GetVersion () returned 0x23f00206 [0071.888] GetCurrentProcess () returned 0xffffffff [0071.888] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19ff60 | out: TokenHandle=0x19ff60*=0x244) returned 1 [0071.888] GetTokenInformation (in: TokenHandle=0x244, TokenInformationClass=0x14, TokenInformation=0x19ff58, TokenInformationLength=0x4, ReturnLength=0x19ff5c | out: TokenInformation=0x19ff58, ReturnLength=0x19ff5c) returned 1 [0071.888] CloseHandle (hObject=0x244) returned 1 [0071.897] GetProcessHeap () returned 0x760000 [0071.902] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e2e0 [0071.902] GetProcessHeap () returned 0x760000 [0071.906] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e150 [0072.143] GetProcessHeap () returned 0x760000 [0072.147] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e178 [0072.147] GetProcessHeap () returned 0x760000 [0072.151] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787138 [0072.152] GetProcessHeap () returned 0x760000 [0072.152] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787138 | out: hHeap=0x760000) returned 1 [0072.152] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x77e150, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0072.152] GetProcessHeap () returned 0x760000 [0072.152] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e178 | out: hHeap=0x760000) returned 1 [0072.152] GetProcessHeap () returned 0x760000 [0072.152] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e2e0 | out: hHeap=0x760000) returned 1 [0072.152] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0072.152] GetProcessHeap () returned 0x760000 [0072.152] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e150 | out: hHeap=0x760000) returned 1 [0072.152] GetProcessHeap () returned 0x760000 [0072.157] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x771d08 [0072.157] GetProcessHeap () returned 0x760000 [0072.162] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x772188 [0072.162] GetProcessHeap () returned 0x760000 [0072.166] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x772188, Size=0x72) returned 0x787138 [0072.166] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x254 [0072.166] WaitForSingleObject (hHandle=0x254, dwMilliseconds=0x0) returned 0x102 [0072.166] CloseHandle (hObject=0x254) returned 1 [0072.166] GetProcessHeap () returned 0x760000 [0072.166] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771d08 | out: hHeap=0x760000) returned 1 [0072.166] GetProcessHeap () returned 0x760000 [0072.166] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787138 | out: hHeap=0x760000) returned 1 [0072.176] Sleep (dwMilliseconds=0x3e8) [0073.391] GetProcessHeap () returned 0x760000 [0073.396] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2678 [0073.396] GetProcessHeap () returned 0x760000 [0073.401] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a26a0 [0073.401] GetProcessHeap () returned 0x760000 [0073.405] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a26c8 [0073.652] GetProcessHeap () returned 0x760000 [0073.657] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x78ed50 [0073.657] GetProcessHeap () returned 0x760000 [0073.657] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x78ed50 | out: hHeap=0x760000) returned 1 [0073.657] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a26a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.657] GetProcessHeap () returned 0x760000 [0073.657] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a26c8 | out: hHeap=0x760000) returned 1 [0073.657] GetProcessHeap () returned 0x760000 [0073.657] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2678 | out: hHeap=0x760000) returned 1 [0073.657] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.658] GetProcessHeap () returned 0x760000 [0073.658] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a26a0 | out: hHeap=0x760000) returned 1 [0073.658] GetProcessHeap () returned 0x760000 [0073.662] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x771f00 [0073.662] GetProcessHeap () returned 0x760000 [0073.667] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x772410 [0073.667] GetProcessHeap () returned 0x760000 [0073.671] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x772410, Size=0x72) returned 0x787960 [0073.672] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2e4 [0073.672] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102 [0073.672] CloseHandle (hObject=0x2e4) returned 1 [0073.672] GetProcessHeap () returned 0x760000 [0073.672] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771f00 | out: hHeap=0x760000) returned 1 [0073.672] GetProcessHeap () returned 0x760000 [0073.672] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0073.681] Sleep (dwMilliseconds=0x3e8) [0075.028] GetProcessHeap () returned 0x760000 [0075.033] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2510 [0075.033] GetProcessHeap () returned 0x760000 [0075.037] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2600 [0075.037] GetProcessHeap () returned 0x760000 [0075.042] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2718 [0075.042] GetProcessHeap () returned 0x760000 [0075.047] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0075.252] GetProcessHeap () returned 0x760000 [0075.252] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0075.252] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2600, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0075.252] GetProcessHeap () returned 0x760000 [0075.252] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2718 | out: hHeap=0x760000) returned 1 [0075.252] GetProcessHeap () returned 0x760000 [0075.252] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2510 | out: hHeap=0x760000) returned 1 [0075.252] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0075.252] GetProcessHeap () returned 0x760000 [0075.252] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2600 | out: hHeap=0x760000) returned 1 [0075.252] GetProcessHeap () returned 0x760000 [0075.257] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8a50 [0075.257] GetProcessHeap () returned 0x760000 [0075.262] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8978 [0075.262] GetProcessHeap () returned 0x760000 [0075.266] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8978, Size=0x72) returned 0x7a3c50 [0075.266] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0075.266] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0075.266] CloseHandle (hObject=0x2f4) returned 1 [0075.266] GetProcessHeap () returned 0x760000 [0075.267] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8a50 | out: hHeap=0x760000) returned 1 [0075.267] GetProcessHeap () returned 0x760000 [0075.267] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0075.276] Sleep (dwMilliseconds=0x3e8) [0076.696] GetProcessHeap () returned 0x760000 [0076.701] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a25d8 [0076.701] GetProcessHeap () returned 0x760000 [0076.705] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2740 [0076.705] GetProcessHeap () returned 0x760000 [0076.709] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a27b8 [0076.709] GetProcessHeap () returned 0x760000 [0076.714] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0076.714] GetProcessHeap () returned 0x760000 [0076.714] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0076.714] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2740, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0076.714] GetProcessHeap () returned 0x760000 [0076.714] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a27b8 | out: hHeap=0x760000) returned 1 [0076.714] GetProcessHeap () returned 0x760000 [0076.714] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a25d8 | out: hHeap=0x760000) returned 1 [0076.714] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0076.714] GetProcessHeap () returned 0x760000 [0076.714] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2740 | out: hHeap=0x760000) returned 1 [0076.714] GetProcessHeap () returned 0x760000 [0076.719] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8810 [0076.719] GetProcessHeap () returned 0x760000 [0076.723] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8c00 [0076.723] GetProcessHeap () returned 0x760000 [0076.728] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8c00, Size=0x72) returned 0x7a3c50 [0077.024] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0077.024] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0077.024] CloseHandle (hObject=0x2f4) returned 1 [0077.024] GetProcessHeap () returned 0x760000 [0077.024] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8810 | out: hHeap=0x760000) returned 1 [0077.024] GetProcessHeap () returned 0x760000 [0077.024] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0077.033] Sleep (dwMilliseconds=0x3e8) [0078.333] GetProcessHeap () returned 0x760000 [0078.337] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a28a8 [0078.338] GetProcessHeap () returned 0x760000 [0078.342] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2768 [0078.342] GetProcessHeap () returned 0x760000 [0078.346] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a24c0 [0078.346] GetProcessHeap () returned 0x760000 [0078.350] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0078.350] GetProcessHeap () returned 0x760000 [0078.350] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0078.350] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2768, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.350] GetProcessHeap () returned 0x760000 [0078.350] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a24c0 | out: hHeap=0x760000) returned 1 [0078.350] GetProcessHeap () returned 0x760000 [0078.350] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a28a8 | out: hHeap=0x760000) returned 1 [0078.350] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.351] GetProcessHeap () returned 0x760000 [0078.351] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2768 | out: hHeap=0x760000) returned 1 [0078.351] GetProcessHeap () returned 0x760000 [0078.355] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a80c0 [0078.355] GetProcessHeap () returned 0x760000 [0078.359] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8588 [0078.359] GetProcessHeap () returned 0x760000 [0078.364] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8588, Size=0x72) returned 0x7a3c50 [0078.816] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0078.816] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0078.816] CloseHandle (hObject=0x2f4) returned 1 [0078.816] GetProcessHeap () returned 0x760000 [0078.816] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a80c0 | out: hHeap=0x760000) returned 1 [0078.816] GetProcessHeap () returned 0x760000 [0078.816] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0078.825] Sleep (dwMilliseconds=0x3e8) [0080.045] GetProcessHeap () returned 0x760000 [0080.085] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2628 [0080.085] GetProcessHeap () returned 0x760000 [0080.085] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2510 [0080.085] GetProcessHeap () returned 0x760000 [0080.085] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2768 [0080.085] GetProcessHeap () returned 0x760000 [0080.085] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0080.085] GetProcessHeap () returned 0x760000 [0080.085] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0080.085] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.085] GetProcessHeap () returned 0x760000 [0080.085] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2768 | out: hHeap=0x760000) returned 1 [0080.085] GetProcessHeap () returned 0x760000 [0080.085] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2628 | out: hHeap=0x760000) returned 1 [0080.085] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.086] GetProcessHeap () returned 0x760000 [0080.086] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2510 | out: hHeap=0x760000) returned 1 [0080.086] GetProcessHeap () returned 0x760000 [0080.086] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a7d18 [0080.086] GetProcessHeap () returned 0x760000 [0080.086] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8390 [0080.086] GetProcessHeap () returned 0x760000 [0080.086] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8390, Size=0x72) returned 0x7a3c50 [0080.086] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0080.086] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0080.086] CloseHandle (hObject=0x2f4) returned 1 [0080.086] GetProcessHeap () returned 0x760000 [0080.086] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a7d18 | out: hHeap=0x760000) returned 1 [0080.086] GetProcessHeap () returned 0x760000 [0080.086] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0080.086] Sleep (dwMilliseconds=0x3e8) [0081.306] GetProcessHeap () returned 0x760000 [0081.306] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a24e8 [0081.309] GetProcessHeap () returned 0x760000 [0081.311] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2808 [0081.312] GetProcessHeap () returned 0x760000 [0081.313] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2510 [0081.314] GetProcessHeap () returned 0x760000 [0081.318] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0081.320] GetProcessHeap () returned 0x760000 [0081.320] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0081.321] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2808, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0081.322] GetProcessHeap () returned 0x760000 [0081.323] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2510 | out: hHeap=0x760000) returned 1 [0081.324] GetProcessHeap () returned 0x760000 [0081.324] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a24e8 | out: hHeap=0x760000) returned 1 [0081.325] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0081.329] GetProcessHeap () returned 0x760000 [0081.329] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2808 | out: hHeap=0x760000) returned 1 [0081.329] GetProcessHeap () returned 0x760000 [0081.329] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a80c0 [0081.329] GetProcessHeap () returned 0x760000 [0081.329] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a7df0 [0081.329] GetProcessHeap () returned 0x760000 [0081.329] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a7df0, Size=0x72) returned 0x7a3c50 [0081.329] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0081.329] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0081.329] CloseHandle (hObject=0x2f4) returned 1 [0081.329] GetProcessHeap () returned 0x760000 [0081.329] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a80c0 | out: hHeap=0x760000) returned 1 [0081.329] GetProcessHeap () returned 0x760000 [0081.329] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0081.329] Sleep (dwMilliseconds=0x3e8) [0082.655] GetProcessHeap () returned 0x760000 [0082.656] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2790 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2588 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2880 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0082.656] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2588, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2880 | out: hHeap=0x760000) returned 1 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2790 | out: hHeap=0x760000) returned 1 [0082.656] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2588 | out: hHeap=0x760000) returned 1 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a89c0 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8780 [0082.656] GetProcessHeap () returned 0x760000 [0082.656] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8780, Size=0x72) returned 0x7a3c50 [0082.657] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0082.657] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0082.657] CloseHandle (hObject=0x2f4) returned 1 [0082.657] GetProcessHeap () returned 0x760000 [0082.657] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a89c0 | out: hHeap=0x760000) returned 1 [0082.657] GetProcessHeap () returned 0x760000 [0082.657] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0082.657] Sleep (dwMilliseconds=0x3e8) [0083.825] GetProcessHeap () returned 0x760000 [0083.825] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a27e0 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2718 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2948 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0083.825] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2718, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2948 | out: hHeap=0x760000) returned 1 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a27e0 | out: hHeap=0x760000) returned 1 [0083.825] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2718 | out: hHeap=0x760000) returned 1 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8588 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a7fe8 [0083.825] GetProcessHeap () returned 0x760000 [0083.825] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a7fe8, Size=0x72) returned 0x7a3c50 [0083.826] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0083.826] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0083.826] CloseHandle (hObject=0x2f4) returned 1 [0083.826] GetProcessHeap () returned 0x760000 [0083.826] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8588 | out: hHeap=0x760000) returned 1 [0083.826] GetProcessHeap () returned 0x760000 [0083.826] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0083.826] Sleep (dwMilliseconds=0x3e8) [0085.141] GetProcessHeap () returned 0x760000 [0085.141] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2920 [0085.141] GetProcessHeap () returned 0x760000 [0085.141] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a28f8 [0085.141] GetProcessHeap () returned 0x760000 [0085.141] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2948 [0085.141] GetProcessHeap () returned 0x760000 [0085.141] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0085.141] GetProcessHeap () returned 0x760000 [0085.141] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0085.141] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a28f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.141] GetProcessHeap () returned 0x760000 [0085.141] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2948 | out: hHeap=0x760000) returned 1 [0085.141] GetProcessHeap () returned 0x760000 [0085.141] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2920 | out: hHeap=0x760000) returned 1 [0085.142] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.142] GetProcessHeap () returned 0x760000 [0085.142] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a28f8 | out: hHeap=0x760000) returned 1 [0085.142] GetProcessHeap () returned 0x760000 [0085.142] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a86a8 [0085.142] GetProcessHeap () returned 0x760000 [0085.142] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8660 [0085.142] GetProcessHeap () returned 0x760000 [0085.142] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8660, Size=0x72) returned 0x7a3c50 [0085.142] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0085.142] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0085.142] CloseHandle (hObject=0x2f4) returned 1 [0085.142] GetProcessHeap () returned 0x760000 [0085.142] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a86a8 | out: hHeap=0x760000) returned 1 [0085.142] GetProcessHeap () returned 0x760000 [0085.142] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0085.142] Sleep (dwMilliseconds=0x3e8) [0086.622] GetProcessHeap () returned 0x760000 [0086.622] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2678 [0086.622] GetProcessHeap () returned 0x760000 [0086.622] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2768 [0086.622] GetProcessHeap () returned 0x760000 [0086.622] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2538 [0086.622] GetProcessHeap () returned 0x760000 [0086.622] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0086.622] GetProcessHeap () returned 0x760000 [0086.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0086.622] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2768, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0086.622] GetProcessHeap () returned 0x760000 [0086.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2538 | out: hHeap=0x760000) returned 1 [0086.622] GetProcessHeap () returned 0x760000 [0086.622] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2678 | out: hHeap=0x760000) returned 1 [0086.622] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0086.623] GetProcessHeap () returned 0x760000 [0086.623] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2768 | out: hHeap=0x760000) returned 1 [0086.623] GetProcessHeap () returned 0x760000 [0086.623] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8bb8 [0086.623] GetProcessHeap () returned 0x760000 [0086.623] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8c90 [0086.623] GetProcessHeap () returned 0x760000 [0086.623] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8c90, Size=0x72) returned 0x7a3c50 [0086.623] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0086.623] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0086.623] CloseHandle (hObject=0x2f4) returned 1 [0086.623] GetProcessHeap () returned 0x760000 [0086.623] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8bb8 | out: hHeap=0x760000) returned 1 [0086.623] GetProcessHeap () returned 0x760000 [0086.623] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0086.623] Sleep (dwMilliseconds=0x3e8) [0087.823] GetProcessHeap () returned 0x760000 [0087.823] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2560 [0087.823] GetProcessHeap () returned 0x760000 [0087.823] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a24e8 [0087.823] GetProcessHeap () returned 0x760000 [0087.823] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a25d8 [0087.823] GetProcessHeap () returned 0x760000 [0087.823] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0087.823] GetProcessHeap () returned 0x760000 [0087.823] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0087.823] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a24e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0087.823] GetProcessHeap () returned 0x760000 [0087.823] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a25d8 | out: hHeap=0x760000) returned 1 [0087.823] GetProcessHeap () returned 0x760000 [0087.823] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2560 | out: hHeap=0x760000) returned 1 [0087.824] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0087.824] GetProcessHeap () returned 0x760000 [0087.824] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a24e8 | out: hHeap=0x760000) returned 1 [0087.824] GetProcessHeap () returned 0x760000 [0087.824] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a81e0 [0087.824] GetProcessHeap () returned 0x760000 [0087.824] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a84f8 [0087.824] GetProcessHeap () returned 0x760000 [0087.824] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a84f8, Size=0x72) returned 0x7a3c50 [0087.824] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0087.824] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0087.824] CloseHandle (hObject=0x2f4) returned 1 [0087.824] GetProcessHeap () returned 0x760000 [0087.824] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a81e0 | out: hHeap=0x760000) returned 1 [0087.824] GetProcessHeap () returned 0x760000 [0087.824] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0087.824] Sleep (dwMilliseconds=0x3e8) [0089.106] GetProcessHeap () returned 0x760000 [0089.106] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2628 [0089.106] GetProcessHeap () returned 0x760000 [0089.106] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a24e8 [0089.106] GetProcessHeap () returned 0x760000 [0089.106] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a24c0 [0089.106] GetProcessHeap () returned 0x760000 [0089.107] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0089.107] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a24e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a24c0 | out: hHeap=0x760000) returned 1 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2628 | out: hHeap=0x760000) returned 1 [0089.107] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a24e8 | out: hHeap=0x760000) returned 1 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8618 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a89c0 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a89c0, Size=0x72) returned 0x7a3c50 [0089.107] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0089.107] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0089.107] CloseHandle (hObject=0x2f4) returned 1 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8618 | out: hHeap=0x760000) returned 1 [0089.107] GetProcessHeap () returned 0x760000 [0089.107] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0089.108] Sleep (dwMilliseconds=0x3e8) [0090.250] GetProcessHeap () returned 0x760000 [0090.251] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2600 [0090.251] GetProcessHeap () returned 0x760000 [0090.253] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a28a8 [0090.253] GetProcessHeap () returned 0x760000 [0090.255] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2538 [0090.258] GetProcessHeap () returned 0x760000 [0090.279] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0090.282] GetProcessHeap () returned 0x760000 [0090.283] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0090.287] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a28a8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0090.295] GetProcessHeap () returned 0x760000 [0090.295] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2538 | out: hHeap=0x760000) returned 1 [0090.295] GetProcessHeap () returned 0x760000 [0090.295] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2600 | out: hHeap=0x760000) returned 1 [0090.295] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0090.296] GetProcessHeap () returned 0x760000 [0090.296] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a28a8 | out: hHeap=0x760000) returned 1 [0090.296] GetProcessHeap () returned 0x760000 [0090.296] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8810 [0090.296] GetProcessHeap () returned 0x760000 [0090.296] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a86f0 [0090.296] GetProcessHeap () returned 0x760000 [0090.296] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a86f0, Size=0x72) returned 0x7a3c50 [0090.296] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0090.296] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0090.296] CloseHandle (hObject=0x2f4) returned 1 [0090.296] GetProcessHeap () returned 0x760000 [0090.296] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8810 | out: hHeap=0x760000) returned 1 [0090.296] GetProcessHeap () returned 0x760000 [0090.296] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0090.296] Sleep (dwMilliseconds=0x3e8) [0091.372] GetProcessHeap () returned 0x760000 [0091.372] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2920 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2948 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2510 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787960 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787960 | out: hHeap=0x760000) returned 1 [0091.372] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2948, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2510 | out: hHeap=0x760000) returned 1 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2920 | out: hHeap=0x760000) returned 1 [0091.372] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2948 | out: hHeap=0x760000) returned 1 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8030 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a7e38 [0091.372] GetProcessHeap () returned 0x760000 [0091.372] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a7e38, Size=0x72) returned 0x7a3c50 [0091.372] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f4 [0091.372] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0091.373] CloseHandle (hObject=0x2f4) returned 1 [0091.373] GetProcessHeap () returned 0x760000 [0091.373] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8030 | out: hHeap=0x760000) returned 1 [0091.373] GetProcessHeap () returned 0x760000 [0091.373] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a3c50 | out: hHeap=0x760000) returned 1 [0091.373] Sleep (dwMilliseconds=0x3e8) [0092.670] GetProcessHeap () returned 0x760000 [0092.670] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2650 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2948 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2768 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x78ede0 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x78ede0 | out: hHeap=0x760000) returned 1 [0092.670] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2948, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2768 | out: hHeap=0x760000) returned 1 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2650 | out: hHeap=0x760000) returned 1 [0092.670] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2948 | out: hHeap=0x760000) returned 1 [0092.670] GetProcessHeap () returned 0x760000 [0092.670] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a86a8 [0092.671] GetProcessHeap () returned 0x760000 [0092.671] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8bb8 [0092.671] GetProcessHeap () returned 0x760000 [0092.671] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8bb8, Size=0x72) returned 0x78ede0 [0092.671] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f0 [0092.671] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102 [0092.671] CloseHandle (hObject=0x2f0) returned 1 [0092.671] GetProcessHeap () returned 0x760000 [0092.671] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a86a8 | out: hHeap=0x760000) returned 1 [0092.671] GetProcessHeap () returned 0x760000 [0092.671] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x78ede0 | out: hHeap=0x760000) returned 1 [0092.671] Sleep (dwMilliseconds=0x3e8) [0093.991] GetProcessHeap () returned 0x760000 [0093.991] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x7a2768 [0093.991] GetProcessHeap () returned 0x760000 [0093.991] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x7a2998 [0093.991] GetProcessHeap () returned 0x760000 [0093.991] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x7a2600 [0093.991] GetProcessHeap () returned 0x760000 [0093.991] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x78ede0 [0093.991] GetProcessHeap () returned 0x760000 [0093.991] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x78ede0 | out: hHeap=0x760000) returned 1 [0093.991] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x7a2998, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0093.991] GetProcessHeap () returned 0x760000 [0093.991] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2600 | out: hHeap=0x760000) returned 1 [0093.991] GetProcessHeap () returned 0x760000 [0093.991] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2768 | out: hHeap=0x760000) returned 1 [0093.991] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fee8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fee8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0093.991] GetProcessHeap () returned 0x760000 [0093.992] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a2998 | out: hHeap=0x760000) returned 1 [0093.992] GetProcessHeap () returned 0x760000 [0093.992] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x7a8858 [0093.992] GetProcessHeap () returned 0x760000 [0093.992] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x3a) returned 0x7a8930 [0093.992] GetProcessHeap () returned 0x760000 [0093.992] RtlReAllocateHeap (Heap=0x760000, Flags=0x0, Ptr=0x7a8930, Size=0x72) returned 0x78ede0 [0093.992] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2f8 [0093.992] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x0) returned 0x102 [0093.992] CloseHandle (hObject=0x2f8) returned 1 [0093.992] GetProcessHeap () returned 0x760000 [0093.992] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x7a8858 | out: hHeap=0x760000) returned 1 [0093.992] GetProcessHeap () returned 0x760000 [0093.992] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x78ede0 | out: hHeap=0x760000) returned 1 [0093.992] Sleep (dwMilliseconds=0x3e8) Thread: id = 23 os_tid = 0xa80 [0071.911] GetCurrentThreadId () returned 0xa80 [0071.921] GetProcessHeap () returned 0x760000 [0071.925] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x440) returned 0x788cf0 [0071.925] GetProcessHeap () returned 0x760000 [0071.930] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x434) returned 0x789138 [0072.176] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0072.184] Process32FirstW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.207] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.207] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.208] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.208] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.209] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.209] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.209] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.210] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.211] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.211] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0072.211] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0072.212] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.212] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.213] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.213] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.214] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.214] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.215] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.215] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.215] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.216] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.216] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.217] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.217] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.218] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.218] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.219] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0072.219] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.220] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.220] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0072.220] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0072.221] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.221] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0072.222] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0072.222] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0072.223] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0072.223] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.224] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.224] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0072.225] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0072.225] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0072.225] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0072.226] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0072.226] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0072.227] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0072.227] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver.exe")) returned 1 [0072.228] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="suite.exe")) returned 1 [0072.228] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0072.229] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="decorating.exe")) returned 1 [0072.229] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="downloadable.exe")) returned 1 [0072.229] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="production meanwhile.exe")) returned 1 [0072.230] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0072.230] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="er_compare.exe")) returned 1 [0072.559] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="anymore_recorder_understood.exe")) returned 1 [0072.560] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="necklace.exe")) returned 1 [0072.560] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neil.exe")) returned 1 [0072.561] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="diverse-spray.exe")) returned 1 [0072.561] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quotations brave.exe")) returned 1 [0072.562] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks.exe")) returned 1 [0072.562] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacketneighborhooddu.exe")) returned 1 [0072.563] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="italian_grove_fame.exe")) returned 1 [0072.563] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="canada lamps camel.exe")) returned 1 [0072.564] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1 [0072.564] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xddc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0072.565] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="distributed_township_imperial.exe")) returned 1 [0072.565] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist tired russell.exe")) returned 1 [0072.566] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity-orbit.exe")) returned 1 [0072.567] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.567] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfac, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.568] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.568] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0072.569] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xefc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf70, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.569] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0072.570] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.570] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x26c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0072.571] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 1 [0072.571] Process32NextW (in: hSnapshot=0x254, lppe=0x1ec2fd30 | out: lppe=0x1ec2fd30*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xd98, pcPriClassBase=8, dwFlags=0x0, szExeFile="GASAS.exe")) returned 0 [0072.571] CloseHandle (hObject=0x254) returned 1 [0072.572] Sleep (dwMilliseconds=0x1f4) [0073.351] GetProcessHeap () returned 0x760000 [0073.351] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x789138 | out: hHeap=0x760000) returned 1 [0073.351] GetProcessHeap () returned 0x760000 [0073.351] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x788cf0 | out: hHeap=0x760000) returned 1 [0073.356] GetCurrentThreadId () returned 0xa80 Thread: id = 24 os_tid = 0x668 [0071.944] GetCurrentThreadId () returned 0x668 [0071.953] GetProcessHeap () returned 0x760000 [0071.957] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x21a) returned 0x789c48 [0071.957] GetProcessHeap () returned 0x760000 [0071.961] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x28) returned 0x7712c0 [0071.961] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x244 [0071.962] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x248 [0071.962] GetComputerNameW (in: lpBuffer=0x789c58, nSize=0x1ed2ff78 | out: lpBuffer="NQDPDE", nSize=0x1ed2ff78) returned 1 [0071.962] GetProcessHeap () returned 0x760000 [0071.967] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e308 [0071.976] GetProcessHeap () returned 0x760000 [0071.980] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x4000) returned 0x789e70 [0071.980] GetProcessHeap () returned 0x760000 [0071.984] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10000) returned 0x78f440 [0072.259] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ed2ff2c | out: lphEnum=0x1ed2ff2c*=0x77a850) returned 0x0 [0073.533] WNetEnumResourceW (in: hEnum=0x77a850, lpcCount=0x1ed2ff20, lpBuffer=0x789e70, lpBufferSize=0x1ed2ff34 | out: lpcCount=0x1ed2ff20, lpBuffer=0x789e70, lpBufferSize=0x1ed2ff34) returned 0x103 [0073.533] WNetCloseEnum (hEnum=0x77a850) returned 0x0 [0073.533] GetProcessHeap () returned 0x760000 [0073.533] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x789e70 | out: hHeap=0x760000) returned 1 [0073.534] GetProcessHeap () returned 0x760000 [0073.534] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x78f440 | out: hHeap=0x760000) returned 1 [0073.534] GetProcessHeap () returned 0x760000 [0073.539] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x4000) returned 0x789e70 [0073.539] GetProcessHeap () returned 0x760000 [0073.543] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10000) returned 0x78f440 [0073.544] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ed2ff14 | out: lphEnum=0x1ed2ff14*=0x770f68) returned 0x0 [0073.545] WNetEnumResourceW (in: hEnum=0x770f68, lpcCount=0x1ed2ff08, lpBuffer=0x789e70, lpBufferSize=0x1ed2ff1c | out: lpcCount=0x1ed2ff08, lpBuffer=0x789e70, lpBufferSize=0x1ed2ff1c) returned 0x103 [0073.545] WNetCloseEnum (hEnum=0x770f68) returned 0x0 [0073.545] GetProcessHeap () returned 0x760000 [0073.545] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x789e70 | out: hHeap=0x760000) returned 1 [0073.545] GetProcessHeap () returned 0x760000 [0073.545] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x78f440 | out: hHeap=0x760000) returned 1 [0073.545] GetProcessHeap () returned 0x760000 [0073.550] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x4000) returned 0x789e70 [0073.550] GetProcessHeap () returned 0x760000 [0073.554] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10000) returned 0x78f440 [0073.554] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x1ed2fefc | out: lphEnum=0x1ed2fefc*=0x77a850) returned 0x0 [0092.571] WNetEnumResourceW (in: hEnum=0x77a850, lpcCount=0x1ed2fef0, lpBuffer=0x789e70, lpBufferSize=0x1ed2ff04 | out: lpcCount=0x1ed2fef0, lpBuffer=0x789e70, lpBufferSize=0x1ed2ff04) returned 0x0 [0092.571] GetProcessHeap () returned 0x760000 [0092.571] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x4000) returned 0x7a8cf0 [0092.571] GetProcessHeap () returned 0x760000 [0092.571] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x10000) returned 0x7accf8 [0092.571] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x789e70, lphEnum=0x1ed2feb4) Thread: id = 25 os_tid = 0xcbc [0071.996] GetCurrentThreadId () returned 0xcbc [0072.006] GetLogicalDrives () returned 0x4 [0072.006] GetProcessHeap () returned 0x760000 [0072.010] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x772218 [0072.010] GetProcessHeap () returned 0x760000 [0072.015] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x28) returned 0x771410 [0072.015] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x24c [0072.015] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x250 [0072.015] GetProcessHeap () returned 0x760000 [0072.019] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e0d8 [0072.020] GetProcessHeap () returned 0x760000 [0072.024] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e330 [0072.024] GetProcessHeap () returned 0x760000 [0072.028] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e178 [0072.260] GetProcessHeap () returned 0x760000 [0072.264] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787138 [0072.265] GetProcessHeap () returned 0x760000 [0072.265] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787138 | out: hHeap=0x760000) returned 1 [0072.265] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x77e330, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0072.265] GetProcessHeap () returned 0x760000 [0072.265] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e178 | out: hHeap=0x760000) returned 1 [0072.265] GetProcessHeap () returned 0x760000 [0072.265] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e0d8 | out: hHeap=0x760000) returned 1 [0072.265] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ee2ff4c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ee2ff4c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0072.265] GetProcessHeap () returned 0x760000 [0072.265] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e330 | out: hHeap=0x760000) returned 1 [0072.274] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0xffffffff) returned 0x0 [0072.274] CloseHandle (hObject=0x250) returned 1 [0072.274] CloseHandle (hObject=0x24c) returned 1 [0072.279] GetProcessHeap () returned 0x760000 [0072.279] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771410 | out: hHeap=0x760000) returned 1 [0072.279] GetProcessHeap () returned 0x760000 [0072.279] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x772218 | out: hHeap=0x760000) returned 1 [0072.283] GetCurrentThreadId () returned 0xcbc Thread: id = 26 os_tid = 0xbe4 [0072.033] GetCurrentThreadId () returned 0xbe4 [0072.043] GetLogicalDrives () returned 0x4 [0072.043] GetProcessHeap () returned 0x760000 [0072.047] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x20) returned 0x77e358 [0072.048] GetProcessHeap () returned 0x760000 [0072.052] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x8, Size=0x1e) returned 0x77e100 [0072.052] GetProcessHeap () returned 0x760000 [0072.057] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x1e) returned 0x77e3a8 [0072.057] GetProcessHeap () returned 0x760000 [0072.061] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x90) returned 0x787138 [0072.288] GetProcessHeap () returned 0x760000 [0072.289] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x787138 | out: hHeap=0x760000) returned 1 [0072.289] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x77e100, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0072.294] GetProcessHeap () returned 0x760000 [0072.294] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e3a8 | out: hHeap=0x760000) returned 1 [0072.294] GetProcessHeap () returned 0x760000 [0072.294] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e358 | out: hHeap=0x760000) returned 1 [0072.294] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1ef6ff44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1ef6ff44*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0072.295] GetProcessHeap () returned 0x760000 [0072.295] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x77e100 | out: hHeap=0x760000) returned 1 [0072.295] GetProcessHeap () returned 0x760000 [0072.299] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x40) returned 0x771d08 [0072.299] GetProcessHeap () returned 0x760000 [0072.304] RtlAllocateHeap (HeapHandle=0x760000, Flags=0x0, Size=0x28) returned 0x771350 [0072.304] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x24c [0072.304] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x250 [0072.314] CloseHandle (hObject=0x250) returned 1 [0072.314] CloseHandle (hObject=0x24c) returned 1 [0072.318] GetProcessHeap () returned 0x760000 [0072.318] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771350 | out: hHeap=0x760000) returned 1 [0072.318] GetProcessHeap () returned 0x760000 [0072.318] HeapFree (in: hHeap=0x760000, dwFlags=0x0, lpMem=0x771d08 | out: hHeap=0x760000) returned 1 [0072.323] GetCurrentThreadId () returned 0xbe4