# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 22.03.2020 09:43:53.807 Process: id = "1" image_name = "qoay92j30os7vchc.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qoay92j30os7vchc.exe" page_root = "0x39d79000" os_pid = "0xb14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QoAY92J30os7vCHc.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb84 [0057.571] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0061.573] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ee820, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0061.595] IsAppThemed () returned 0x1 [0061.599] CoTaskMemAlloc (cb=0xf0) returned 0x97d870 [0061.599] CreateActCtxA (pActCtx=0x2eedf0) returned 0x963ea8 [0061.717] CoTaskMemFree (pv=0x97d870) [0061.734] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc167 [0061.734] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc169 [0061.766] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0061.768] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7fef4740000 [0062.947] AdjustWindowRectEx (in: lpRect=0x2eee90, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2eee90) returned 1 [0062.951] GetCurrentProcess () returned 0xffffffffffffffff [0062.951] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x2eeca0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2eeca0*=0x1c8) returned 1 [0062.976] GetCurrentActCtx (in: lphActCtx=0x2eeb90 | out: lphActCtx=0x2eeb90*=0x0) returned 1 [0062.976] ActivateActCtx (in: hActCtx=0x963ea8, lpCookie=0x2eebd0 | out: hActCtx=0x963ea8, lpCookie=0x2eebd0) returned 1 [0062.976] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0062.979] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7fefc4e0000 [0064.411] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77840000 [0064.412] GetProcAddress (hModule=0x77840000, lpProcName="DefWindowProcW") returned 0x77a8b0ac [0064.413] GetStockObject (i=5) returned 0x1900015 [0064.460] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0064.464] CoTaskMemAlloc (cb=0x5c) returned 0x186500 [0064.464] RegisterClassW (lpWndClass=0x2ee870) returned 0xc121 [0064.465] CoTaskMemFree (pv=0x186500) [0064.465] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0064.465] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x13c0000, lpParam=0x0) returned 0x40160 [0064.474] SetWindowLongPtrW (hWnd=0x40160, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1ade131c [0064.477] GetWindowLongPtrW (hWnd=0x40160, nIndex=-4) returned 0x77a8b0ac [0064.606] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x2edcb8 | out: phkResult=0x2edcb8*=0x1e8) returned 0x0 [0064.607] RegQueryValueExW (in: hKey=0x1e8, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x2edd08, lpData=0x0, lpcbData=0x2edd00*=0x0 | out: lpType=0x2edd08*=0x0, lpData=0x0, lpcbData=0x2edd00*=0x0) returned 0x2 [0064.608] RegQueryValueExW (in: hKey=0x1e8, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x2edd08, lpData=0x0, lpcbData=0x2edd00*=0x0 | out: lpType=0x2edd08*=0x0, lpData=0x0, lpcbData=0x2edd00*=0x0) returned 0x2 [0064.609] RegCloseKey (hKey=0x1e8) returned 0x0 [0064.611] SetWindowLongPtrW (hWnd=0x40160, nIndex=-4, dwNewLong=0x1ade136c) returned 0x77a8b0ac [0064.611] GetWindowLongPtrW (hWnd=0x40160, nIndex=-4) returned 0x1ade136c [0064.611] GetWindowLongPtrW (hWnd=0x40160, nIndex=-16) returned 0x6c10000 [0064.614] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc122 [0064.615] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc161 [0064.615] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x40160, Msg=0x81, wParam=0x0, lParam=0x2ee250) returned 0x1 [0064.616] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x40160, Msg=0x83, wParam=0x0, lParam=0x2ee300) returned 0x0 [0064.616] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x40160, Msg=0x1, wParam=0x0, lParam=0x2ee250) returned 0x0 [0064.617] GetClientRect (in: hWnd=0x40160, lpRect=0x2edd10 | out: lpRect=0x2edd10) returned 1 [0064.617] GetWindowRect (in: hWnd=0x40160, lpRect=0x2edd10 | out: lpRect=0x2edd10) returned 1 [0064.621] GetParent (hWnd=0x40160) returned 0x0 [0064.621] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001c12c00000001) returned 1 [0064.707] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef4740000 [0064.708] AdjustWindowRectEx (in: lpRect=0x2eee38, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2eee38) returned 1 [0064.708] GetSystemMetrics (nIndex=59) returned 1460 [0064.708] GetSystemMetrics (nIndex=60) returned 920 [0064.708] GetSystemMetrics (nIndex=34) returned 132 [0064.708] GetSystemMetrics (nIndex=35) returned 38 [0064.708] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef4740000 [0064.708] AdjustWindowRectEx (in: lpRect=0x2eebf8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2eebf8) returned 1 [0064.718] CreateCompatibleDC (hdc=0x0) returned 0xc010995 [0064.727] GetSystemDefaultLCID () returned 0x409 [0064.727] GetStockObject (i=17) returned 0x18a0025 [0064.730] GetObjectW (in: h=0x18a0025, c=92, pv=0x2ee920 | out: pv=0x2ee920) returned 92 [0064.731] GetDC (hWnd=0x0) returned 0x30109b2 [0064.753] GdiplusStartup (in: token=0x7fe94116cf8, input=0x2ed228, output=0x2ed2d8 | out: token=0x7fe94116cf8, output=0x2ed2d8) returned 0x0 [0064.762] CoTaskMemAlloc (cb=0x5c) returned 0x9a5f50 [0064.763] GdipCreateFontFromLogfontW (hdc=0x30109b2, logfont=0x9a5f50, font=0x2eea60) returned 0x0 [0064.916] CoTaskMemFree (pv=0x9a5f50) [0064.917] CoTaskMemAlloc (cb=0x5c) returned 0x9a5f50 [0064.917] CoTaskMemFree (pv=0x9a5f50) [0064.919] CoTaskMemAlloc (cb=0x5c) returned 0x9a5f50 [0064.919] CoTaskMemFree (pv=0x9a5f50) [0064.920] GdipGetFontUnit (font=0x1b3241a0, unit=0x2ee9d0) returned 0x0 [0064.920] GdipGetFontSize (font=0x1b3241a0, size=0x2ee9dc) returned 0x0 [0064.921] GdipGetFontStyle (font=0x1b3241a0, style=0x2ee9c8) returned 0x0 [0064.922] GdipGetFamily (font=0x1b3241a0, family=0x2ee9c0) returned 0x0 [0064.925] GdipGetFontSize (font=0x1b3241a0, size=0x27dcf30) returned 0x0 [0064.925] ReleaseDC (hWnd=0x0, hDC=0x30109b2) returned 1 [0064.929] GetDC (hWnd=0x0) returned 0x200107c4 [0064.929] GdipCreateFromHDC (hdc=0x200107c4, graphics=0x2ee9d8) returned 0x0 [0064.933] GdipGetDpiY (graphics=0x1ad0d3c0, dpi=0x27dd108) returned 0x0 [0064.934] GdipGetFontHeight (font=0x1b3241a0, graphics=0x1ad0d3c0, height=0x2ee9d4) returned 0x0 [0064.935] GdipGetEmHeight (family=0x1b32c5e0, style=0, EmHeight=0x2ee9d8) returned 0x0 [0064.936] GdipGetLineSpacing (family=0x1b32c5e0, style=0, LineSpacing=0x2ee9d8) returned 0x0 [0064.936] GdipDeleteGraphics (graphics=0x1ad0d3c0) returned 0x0 [0064.937] ReleaseDC (hWnd=0x0, hDC=0x200107c4) returned 1 [0064.943] GdipCreateFont (fontFamily=0x1b32c5e0, emSize=0x7fef140cd25, style=0, unit=0x3, font=0x27dd098) returned 0x0 [0064.943] GdipGetFontSize (font=0x1ad73a40, size=0x27dd0a0) returned 0x0 [0064.944] GdipDeleteFont (font=0x1b3241a0) returned 0x0 [0064.947] GetDC (hWnd=0x0) returned 0x200107c4 [0064.947] GdipCreateFromHDC (hdc=0x200107c4, graphics=0x2eea88) returned 0x0 [0064.948] CoTaskMemAlloc (cb=0x5c) returned 0x9a5f50 [0064.948] GdipGetLogFontW (font=0x1ad73a40, graphics=0x1ad0d3c0, logfontW=0x9a5f50) returned 0x0 [0064.948] CoTaskMemFree (pv=0x9a5f50) [0064.948] CoTaskMemAlloc (cb=0x5c) returned 0x9a5f50 [0064.948] CoTaskMemFree (pv=0x9a5f50) [0064.949] CoTaskMemAlloc (cb=0x5c) returned 0x9a5f50 [0064.949] CoTaskMemFree (pv=0x9a5f50) [0064.949] GdipDeleteGraphics (graphics=0x1ad0d3c0) returned 0x0 [0064.949] ReleaseDC (hWnd=0x0, hDC=0x200107c4) returned 1 [0064.949] CoTaskMemAlloc (cb=0x5c) returned 0x9a5f50 [0064.949] CreateFontIndirectW (lplf=0x9a5f50) returned 0x80a09d3 [0064.950] CoTaskMemFree (pv=0x9a5f50) [0064.950] SelectObject (hdc=0xc010995, h=0x80a09d3) returned 0x18a002e [0064.951] GetTextMetricsW (in: hdc=0xc010995, lptm=0x2eed08 | out: lptm=0x2eed08) returned 1 [0064.951] GetTextExtentPoint32W (in: hdc=0xc010995, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x27dd480 | out: psizl=0x27dd480) returned 1 [0064.955] SelectObject (hdc=0xc010995, h=0x18a002e) returned 0x80a09d3 [0064.956] DeleteDC (hdc=0xc010995) returned 1 [0064.956] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef4740000 [0064.956] AdjustWindowRectEx (in: lpRect=0x2ee970, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee970) returned 1 [0064.957] AdjustWindowRectEx (in: lpRect=0x2eebf0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2eebf0) returned 1 [0064.957] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef4740000 [0064.957] AdjustWindowRectEx (in: lpRect=0x2ee860, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee860) returned 1 [0064.957] AdjustWindowRectEx (in: lpRect=0x2ee9e0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee9e0) returned 1 [0064.959] GetSystemMetrics (nIndex=34) returned 132 [0064.959] GetSystemMetrics (nIndex=35) returned 38 [0064.961] GetCurrentActCtx (in: lphActCtx=0x2eeee0 | out: lphActCtx=0x2eeee0*=0x0) returned 1 [0064.961] ActivateActCtx (in: hActCtx=0x963ea8, lpCookie=0x2eef20 | out: hActCtx=0x963ea8, lpCookie=0x2eef20) returned 1 [0064.971] GetCurrentActCtx (in: lphActCtx=0x2eeb70 | out: lphActCtx=0x2eeb70*=0x963ea8) returned 1 [0064.971] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0064.971] AdjustWindowRectEx (in: lpRect=0x2eea90, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2eea90) returned 1 [0064.971] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0064.971] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=132, nHeight=58, hWndParent=0x0, hMenu=0x0, hInstance=0x13c0000, lpParam=0x0) returned 0x50116 [0064.972] SetWindowLongPtrW (hWnd=0x50116, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1ade131c [0064.972] GetWindowLongPtrW (hWnd=0x50116, nIndex=-4) returned 0x77a8b0ac [0064.972] SetWindowLongPtrW (hWnd=0x50116, nIndex=-4, dwNewLong=0x1ade13bc) returned 0x77a8b0ac [0064.972] GetWindowLongPtrW (hWnd=0x50116, nIndex=-4) returned 0x1ade13bc [0064.972] GetWindowLongPtrW (hWnd=0x50116, nIndex=-16) returned 0x6cf0000 [0064.974] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x81, wParam=0x0, lParam=0x2ee230) returned 0x1 [0064.975] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x83, wParam=0x0, lParam=0x2ee2e0) returned 0x0 [0065.249] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x1, wParam=0x0, lParam=0x2ee210) returned 0x0 [0065.249] GetClientRect (in: hWnd=0x50116, lpRect=0x2edc90 | out: lpRect=0x2edc90) returned 1 [0065.249] GetWindowRect (in: hWnd=0x50116, lpRect=0x2edc90 | out: lpRect=0x2edc90) returned 1 [0065.250] SetWindowTextW (hWnd=0x50116, lpString="Form1") returned 1 [0065.250] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xc, wParam=0x0, lParam=0x27dc2bc) returned 0x1 [0065.377] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x27ddca0, nLength=0xc, lpnLengthNeeded=0x2eda20 | out: pvInfo=0x27ddca0, lpnLengthNeeded=0x2eda20) returned 1 [0065.399] SetConsoleCtrlHandler (HandlerRoutine=0x1ade140c, Add=1) returned 1 [0065.406] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0065.407] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0065.409] GetClassInfoW (in: hInstance=0x13c0000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x27ddd60 | out: lpWndClass=0x27ddd60) returned 0 [0065.410] CoTaskMemAlloc (cb=0x58) returned 0x1802e0 [0065.410] RegisterClassW (lpWndClass=0x2ed830) returned 0xc163 [0065.410] CoTaskMemFree (pv=0x1802e0) [0065.411] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x13c0000, lpParam=0x0) returned 0x30268 [0065.920] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x83, wParam=0x0, lParam=0x2ed250) returned 0x0 [0065.920] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x1, wParam=0x0, lParam=0x2ed140) returned 0x0 [0065.920] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0065.921] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0065.950] GetStartupInfoW (in: lpStartupInfo=0x27de498 | out: lpStartupInfo=0x27de498*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QoAY92J30os7vCHc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0065.952] GetParent (hWnd=0x50116) returned 0x0 [0065.952] SetWindowLongPtrW (hWnd=0x50116, nIndex=-8, dwNewLong=0x0) returned 0x0 [0066.001] GetSystemMetrics (nIndex=11) returned 32 [0066.001] GetSystemMetrics (nIndex=12) returned 32 [0066.001] GetDC (hWnd=0x0) returned 0x200107c4 [0066.002] GetDeviceCaps (hdc=0x200107c4, index=12) returned 32 [0066.002] GetDeviceCaps (hdc=0x200107c4, index=14) returned 1 [0066.002] ReleaseDC (hWnd=0x0, hDC=0x200107c4) returned 1 [0066.002] CreateIconFromResourceEx (presbits=0x27e10f0, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x900ff [0066.004] GetSystemMetrics (nIndex=49) returned 16 [0066.004] GetSystemMetrics (nIndex=50) returned 16 [0066.006] CreateIconFromResourceEx (presbits=0x27e21f8, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x1a0187 [0066.008] SendMessageW (hWnd=0x50116, Msg=0x80, wParam=0x0, lParam=0x1a0187) returned 0x0 [0066.008] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x80, wParam=0x0, lParam=0x1a0187) returned 0x0 [0066.008] SendMessageW (hWnd=0x50116, Msg=0x80, wParam=0x1, lParam=0x900ff) returned 0x0 [0066.008] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x80, wParam=0x1, lParam=0x900ff) returned 0x0 [0066.053] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x1a0187 [0066.057] GetSystemMenu (hWnd=0x50116, bRevert=0) returned 0x100183 [0066.060] GetWindowPlacement (in: hWnd=0x50116, lpwndpl=0x2eeb78 | out: lpwndpl=0x2eeb78) returned 1 [0066.060] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0066.060] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0066.060] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0066.060] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0066.060] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0066.061] GetClientRect (in: hWnd=0x50116, lpRect=0x2eec40 | out: lpRect=0x2eec40) returned 1 [0066.061] GetClientRect (in: hWnd=0x50116, lpRect=0x2eeb70 | out: lpRect=0x2eeb70) returned 1 [0066.061] GetWindowRect (in: hWnd=0x50116, lpRect=0x2eeb70 | out: lpRect=0x2eeb70) returned 1 [0066.061] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0066.061] GetWindowLongPtrW (hWnd=0x50116, nIndex=-16) returned 0x6cf0000 [0066.062] GetWindowTextLengthW (hWnd=0x50116) returned 5 [0066.062] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.062] GetSystemMetrics (nIndex=42) returned 0 [0066.062] GetWindowTextW (in: hWnd=0x50116, lpString=0x2ee980, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.062] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xd, wParam=0x6, lParam=0x2ee980) returned 0x5 [0066.063] GetWindowTextLengthW (hWnd=0x50116) returned 5 [0066.063] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.063] GetSystemMetrics (nIndex=42) returned 0 [0066.063] GetWindowTextW (in: hWnd=0x50116, lpString=0x2ee980, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.063] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xd, wParam=0x6, lParam=0x2ee980) returned 0x5 [0066.063] GetWindowLongPtrW (hWnd=0x50116, nIndex=-16) returned 0x6cf0000 [0066.063] GetWindowLongPtrW (hWnd=0x50116, nIndex=-20) returned 0x50100 [0066.063] SetWindowLongPtrW (hWnd=0x50116, nIndex=-16, dwNewLong=0x2cf0000) returned 0x6cf0000 [0066.064] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2eea50) returned 0x0 [0066.064] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2eea50) returned 0x0 [0066.064] SetWindowLongPtrW (hWnd=0x50116, nIndex=-20, dwNewLong=0x50000) returned 0x50100 [0066.064] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2eea50) returned 0x0 [0066.064] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2eea50) returned 0x0 [0066.065] SetWindowPos (hWnd=0x50116, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0066.065] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x46, wParam=0x0, lParam=0x2eeaa0) returned 0x0 [0066.065] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x83, wParam=0x1, lParam=0x2eea70) returned 0x0 [0066.066] GetWindowPlacement (in: hWnd=0x50116, lpwndpl=0x2ee678 | out: lpwndpl=0x2ee678) returned 1 [0066.066] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x47, wParam=0x0, lParam=0x2eeaa0) returned 0x0 [0066.066] GetClientRect (in: hWnd=0x50116, lpRect=0x2ee510 | out: lpRect=0x2ee510) returned 1 [0066.066] GetWindowRect (in: hWnd=0x50116, lpRect=0x2ee510 | out: lpRect=0x2ee510) returned 1 [0066.069] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x83, wParam=0x1, lParam=0x2ee400) returned 0x0 [0066.069] RedrawWindow (hWnd=0x50116, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0066.069] GetSystemMenu (hWnd=0x50116, bRevert=0) returned 0x100183 [0066.069] GetWindowPlacement (in: hWnd=0x50116, lpwndpl=0x2eeb18 | out: lpwndpl=0x2eeb18) returned 1 [0066.070] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0066.070] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0066.070] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0066.070] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0066.070] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0066.070] ShowWindow (hWnd=0x50116, nCmdShow=5) [0066.070] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0066.071] GetWindowTextLengthW (hWnd=0x50116) returned 5 [0066.071] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.071] GetSystemMetrics (nIndex=42) returned 0 [0066.071] GetWindowTextW (in: hWnd=0x50116, lpString=0x2ee4e0, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.071] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xd, wParam=0x6, lParam=0x2ee4e0) returned 0x5 [0066.092] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0066.092] GetWindowLongPtrW (hWnd=0x50116, nIndex=-16) returned 0x6cf0000 [0066.093] GetWindowTextLengthW (hWnd=0x50116) returned 5 [0066.093] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.093] GetSystemMetrics (nIndex=42) returned 0 [0066.093] GetWindowTextW (in: hWnd=0x50116, lpString=0x2ee200, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.093] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xd, wParam=0x6, lParam=0x2ee200) returned 0x5 [0066.093] GetWindowTextLengthW (hWnd=0x50116) returned 5 [0066.093] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.093] GetSystemMetrics (nIndex=42) returned 0 [0066.093] GetWindowTextW (in: hWnd=0x50116, lpString=0x2ee200, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.093] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xd, wParam=0x6, lParam=0x2ee200) returned 0x5 [0066.093] GetWindowLongPtrW (hWnd=0x50116, nIndex=-16) returned 0x6cf0000 [0066.093] GetWindowLongPtrW (hWnd=0x50116, nIndex=-20) returned 0x50100 [0066.093] SetWindowLongPtrW (hWnd=0x50116, nIndex=-16, dwNewLong=0x12cf0000) returned 0x6cf0000 [0066.094] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2ee2d0) returned 0x0 [0066.094] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2ee2d0) returned 0x0 [0066.094] SetWindowLongPtrW (hWnd=0x50116, nIndex=-20, dwNewLong=0xd0000) returned 0x50100 [0066.094] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2ee2d0) returned 0x0 [0066.106] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2ee2d0) returned 0x0 [0066.107] SetWindowPos (hWnd=0x50116, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0066.107] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x46, wParam=0x0, lParam=0x2ee320) returned 0x0 [0066.107] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x83, wParam=0x1, lParam=0x2ee2f0) returned 0x0 [0066.108] GetWindowPlacement (in: hWnd=0x50116, lpwndpl=0x2edef8 | out: lpwndpl=0x2edef8) returned 1 [0066.108] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x47, wParam=0x0, lParam=0x2ee320) returned 0x0 [0066.108] GetClientRect (in: hWnd=0x50116, lpRect=0x2edd90 | out: lpRect=0x2edd90) returned 1 [0066.108] GetWindowRect (in: hWnd=0x50116, lpRect=0x2edd90 | out: lpRect=0x2edd90) returned 1 [0066.108] RedrawWindow (hWnd=0x50116, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0066.108] GetSystemMenu (hWnd=0x50116, bRevert=0) returned 0x100183 [0066.108] GetWindowPlacement (in: hWnd=0x50116, lpwndpl=0x2ee398 | out: lpwndpl=0x2ee398) returned 1 [0066.108] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0066.108] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0066.108] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0066.108] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0066.108] EnableMenuItem (hMenu=0x100183, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0066.124] SetLayeredWindowAttributes (hwnd=0x50116, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0066.134] GetCurrentThreadId () returned 0xb84 [0066.140] EnumThreadWindows (dwThreadId=0xb84, lpfn=0x1ade14ac, lParam=0x50116) returned 1 [0066.190] GetWindowLongPtrW (hWnd=0x30268, nIndex=-8) returned 0x0 [0066.190] GetWindowLongPtrW (hWnd=0x50116, nIndex=-8) returned 0x0 [0066.190] GetWindowLongPtrW (hWnd=0x50114, nIndex=-8) returned 0x50116 [0066.262] SetWindowLongPtrW (hWnd=0x50114, nIndex=-8, dwNewLong=0x0) returned 0x50116 [0066.265] GetParent (hWnd=0x50116) returned 0x0 [0066.265] GetWindowLongPtrW (hWnd=0x50116, nIndex=-20) returned 0xd0100 [0066.266] DestroyWindow (hWnd=0x50116) returned 1 [0066.266] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0066.266] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x46, wParam=0x0, lParam=0x2ee180) returned 0x0 [0066.269] GetWindowPlacement (in: hWnd=0x50116, lpwndpl=0x2edd58 | out: lpwndpl=0x2edd58) returned 1 [0066.269] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x47, wParam=0x0, lParam=0x2ee180) returned 0x0 [0066.269] GetClientRect (in: hWnd=0x50116, lpRect=0x2edbf0 | out: lpRect=0x2edbf0) returned 1 [0066.269] GetWindowRect (in: hWnd=0x50116, lpRect=0x2edbf0 | out: lpRect=0x2edbf0) returned 1 [0066.273] GetWindowTextLengthW (hWnd=0x50116) returned 5 [0066.273] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.273] GetSystemMetrics (nIndex=42) returned 0 [0066.273] GetWindowTextW (in: hWnd=0x50116, lpString=0x2eda60, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.273] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0xd, wParam=0x6, lParam=0x2eda60) returned 0x5 [0066.273] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0066.274] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50116, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0066.280] GetCurrentActCtx (in: lphActCtx=0x2ee250 | out: lphActCtx=0x2ee250*=0x963ea8) returned 1 [0066.280] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0066.281] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0066.281] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=125, Y=125, nWidth=132, nHeight=58, hWndParent=0x0, hMenu=0x0, hInstance=0x13c0000, lpParam=0x0) returned 0x50162 [0066.281] SetWindowLongPtrW (hWnd=0x50162, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1ade131c [0066.281] GetWindowLongPtrW (hWnd=0x50162, nIndex=-4) returned 0x77a8b0ac [0066.281] SetWindowLongPtrW (hWnd=0x50162, nIndex=-4, dwNewLong=0x1ade14fc) returned 0x77a8b0ac [0066.281] GetWindowLongPtrW (hWnd=0x50162, nIndex=-4) returned 0x1ade14fc [0066.281] GetWindowLongPtrW (hWnd=0x50162, nIndex=-16) returned 0x6cf0000 [0066.283] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x81, wParam=0x0, lParam=0x2ed910) returned 0x1 [0066.283] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x83, wParam=0x0, lParam=0x2ed9c0) returned 0x0 [0066.283] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x1, wParam=0x0, lParam=0x2ed8f0) returned 0x0 [0066.283] GetClientRect (in: hWnd=0x50162, lpRect=0x2ed370 | out: lpRect=0x2ed370) returned 1 [0066.283] GetWindowRect (in: hWnd=0x50162, lpRect=0x2ed370 | out: lpRect=0x2ed370) returned 1 [0066.284] SetWindowTextW (hWnd=0x50162, lpString="Form1") returned 1 [0066.284] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xc, wParam=0x0, lParam=0x27e2f4c) returned 0x1 [0066.284] SetLayeredWindowAttributes (hwnd=0x50162, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0066.285] GetStartupInfoW (in: lpStartupInfo=0x27e3438 | out: lpStartupInfo=0x27e3438*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QoAY92J30os7vCHc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0066.285] GetParent (hWnd=0x50162) returned 0x0 [0066.286] GetStockObject (i=5) returned 0x1900015 [0066.286] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0066.287] CoTaskMemAlloc (cb=0x5c) returned 0x9a8be0 [0066.287] RegisterClassW (lpWndClass=0x2edf40) returned 0xc164 [0066.287] CoTaskMemFree (pv=0x9a8be0) [0066.287] GetModuleHandleW (lpModuleName=0x0) returned 0x13c0000 [0066.287] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x13c0000, lpParam=0x0) returned 0x4015c [0066.287] SetWindowLongPtrW (hWnd=0x4015c, nIndex=-4, dwNewLong=0x77a8b0ac) returned 0x1ade154c [0066.287] GetWindowLongPtrW (hWnd=0x4015c, nIndex=-4) returned 0x77a8b0ac [0066.287] SetWindowLongPtrW (hWnd=0x4015c, nIndex=-4, dwNewLong=0x1ade159c) returned 0x77a8b0ac [0066.287] GetWindowLongPtrW (hWnd=0x4015c, nIndex=-4) returned 0x1ade159c [0066.287] GetWindowLongPtrW (hWnd=0x4015c, nIndex=-16) returned 0x4c00000 [0066.288] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x24, wParam=0x0, lParam=0x2ed9b0) returned 0x0 [0066.289] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x81, wParam=0x0, lParam=0x2ed920) returned 0x1 [0066.289] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x83, wParam=0x0, lParam=0x2ed9d0) returned 0x0 [0066.289] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x1, wParam=0x0, lParam=0x2ed920) returned 0x0 [0066.289] SetWindowLongPtrW (hWnd=0x50162, nIndex=-8, dwNewLong=0x4015c) returned 0x0 [0066.290] SendMessageW (hWnd=0x50162, Msg=0x80, wParam=0x0, lParam=0x1a0187) returned 0x0 [0066.290] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x80, wParam=0x0, lParam=0x1a0187) returned 0x0 [0066.290] SendMessageW (hWnd=0x50162, Msg=0x80, wParam=0x1, lParam=0x900ff) returned 0x0 [0066.290] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x80, wParam=0x1, lParam=0x900ff) returned 0x0 [0066.290] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x1a0187 [0066.291] GetSystemMenu (hWnd=0x50162, bRevert=0) returned 0x110183 [0066.291] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2ee258 | out: lpwndpl=0x2ee258) returned 1 [0066.291] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0066.291] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0066.291] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0066.291] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0066.291] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0066.291] GetClientRect (in: hWnd=0x50162, lpRect=0x2ee320 | out: lpRect=0x2ee320) returned 1 [0066.291] GetClientRect (in: hWnd=0x50162, lpRect=0x2ee250 | out: lpRect=0x2ee250) returned 1 [0066.291] GetWindowRect (in: hWnd=0x50162, lpRect=0x2ee250 | out: lpRect=0x2ee250) returned 1 [0066.291] SetWindowPos (hWnd=0x50162, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0066.291] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x46, wParam=0x0, lParam=0x2ee1b0) returned 0x0 [0066.295] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0066.297] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2edda8 | out: lpwndpl=0x2edda8) returned 1 [0066.297] GetClientRect (in: hWnd=0x50162, lpRect=0x2edcc0 | out: lpRect=0x2edcc0) returned 1 [0066.297] GetWindowTextLengthW (hWnd=0x50162) returned 5 [0066.297] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.297] GetSystemMetrics (nIndex=42) returned 0 [0066.297] GetWindowTextW (in: hWnd=0x50162, lpString=0x2eda30, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.297] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xd, wParam=0x6, lParam=0x2eda30) returned 0x5 [0066.297] GetClientRect (in: hWnd=0x50162, lpRect=0x2edaa8 | out: lpRect=0x2edaa8) returned 1 [0066.302] GetSysColor (nIndex=10) returned 0xb4b4b4 [0066.302] GetSysColor (nIndex=2) returned 0xd1b499 [0066.302] GetSysColor (nIndex=9) returned 0x0 [0066.302] GetSysColor (nIndex=12) returned 0xababab [0066.302] GetSysColor (nIndex=15) returned 0xf0f0f0 [0066.302] GetSysColor (nIndex=20) returned 0xffffff [0066.302] GetSysColor (nIndex=16) returned 0xa0a0a0 [0066.302] GetSysColor (nIndex=15) returned 0xf0f0f0 [0066.302] GetSysColor (nIndex=16) returned 0xa0a0a0 [0066.302] GetSysColor (nIndex=21) returned 0x696969 [0066.302] GetSysColor (nIndex=22) returned 0xe3e3e3 [0066.302] GetSysColor (nIndex=20) returned 0xffffff [0066.302] GetSysColor (nIndex=18) returned 0x0 [0066.302] GetSysColor (nIndex=1) returned 0x0 [0066.302] GetSysColor (nIndex=27) returned 0xead1b9 [0066.302] GetSysColor (nIndex=28) returned 0xf2e4d7 [0066.302] GetSysColor (nIndex=17) returned 0x6d6d6d [0066.302] GetSysColor (nIndex=13) returned 0xff9933 [0066.302] GetSysColor (nIndex=14) returned 0xffffff [0066.303] GetSysColor (nIndex=26) returned 0xcc6600 [0066.303] GetSysColor (nIndex=11) returned 0xfcf7f4 [0066.303] GetSysColor (nIndex=3) returned 0xdbcdbf [0066.303] GetSysColor (nIndex=19) returned 0x544e43 [0066.303] GetSysColor (nIndex=24) returned 0xe1ffff [0066.303] GetSysColor (nIndex=23) returned 0x0 [0066.303] GetSysColor (nIndex=4) returned 0xf0f0f0 [0066.303] GetSysColor (nIndex=30) returned 0xf0f0f0 [0066.303] GetSysColor (nIndex=29) returned 0xff9933 [0066.303] GetSysColor (nIndex=7) returned 0x0 [0066.303] GetSysColor (nIndex=0) returned 0xc8c8c8 [0066.303] GetSysColor (nIndex=5) returned 0xffffff [0066.303] GetSysColor (nIndex=6) returned 0x646464 [0066.303] GetSysColor (nIndex=8) returned 0x0 [0066.304] GetSystemMetrics (nIndex=80) returned 1 [0066.306] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x1ade15ec, dwData=0x0) returned 1 [0066.307] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ed2a0 | out: lpmi=0x2ed2a0) returned 1 [0066.307] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x4f0101b1 [0066.308] GetDeviceCaps (hdc=0x4f0101b1, index=12) returned 32 [0066.308] GetDeviceCaps (hdc=0x4f0101b1, index=14) returned 1 [0066.308] DeleteDC (hdc=0x4f0101b1) returned 1 [0066.311] GetCurrentObject (hdc=0x30109b2, type=0x1) returned 0x1b00017 [0066.311] GetCurrentObject (hdc=0x30109b2, type=0x2) returned 0x1900010 [0066.311] GetCurrentObject (hdc=0x30109b2, type=0x7) returned 0x1c0501a0 [0066.311] GetCurrentObject (hdc=0x30109b2, type=0x6) returned 0x18a002e [0066.314] SaveDC (hdc=0x30109b2) returned 1 [0066.317] GetNearestColor (hdc=0x30109b2, color=0xf0f0f0) returned 0xf0f0f0 [0066.322] CreateSolidBrush (color=0xf0f0f0) returned 0x14100283 [0066.323] FillRect (hDC=0x30109b2, lprc=0x2ed798, hbr=0x14100283) returned 1 [0066.325] DeleteObject (ho=0x14100283) returned 1 [0066.327] RestoreDC (hdc=0x30109b2, nSavedDC=-1) returned 1 [0066.330] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2edd88 | out: lpwndpl=0x2edd88) returned 1 [0066.330] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x47, wParam=0x0, lParam=0x2ee1b0) returned 0x0 [0066.331] GetClientRect (in: hWnd=0x50162, lpRect=0x2edc20 | out: lpRect=0x2edc20) returned 1 [0066.331] GetWindowRect (in: hWnd=0x50162, lpRect=0x2edc20 | out: lpRect=0x2edc20) returned 1 [0066.331] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x83, wParam=0x1, lParam=0x2edb10) returned 0x0 [0066.335] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0066.337] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2ed738 | out: lpwndpl=0x2ed738) returned 1 [0066.337] GetClientRect (in: hWnd=0x50162, lpRect=0x2ed650 | out: lpRect=0x2ed650) returned 1 [0066.337] GetWindowTextLengthW (hWnd=0x50162) returned 5 [0066.337] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.337] GetSystemMetrics (nIndex=42) returned 0 [0066.337] GetWindowTextW (in: hWnd=0x50162, lpString=0x2ed3c0, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.337] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xd, wParam=0x6, lParam=0x2ed3c0) returned 0x5 [0066.337] GetClientRect (in: hWnd=0x50162, lpRect=0x2ed438 | out: lpRect=0x2ed438) returned 1 [0066.337] GetCurrentObject (hdc=0x200107c4, type=0x1) returned 0x1b00017 [0066.338] GetCurrentObject (hdc=0x200107c4, type=0x2) returned 0x1900010 [0066.338] GetCurrentObject (hdc=0x200107c4, type=0x7) returned 0x1c0501a0 [0066.338] GetCurrentObject (hdc=0x200107c4, type=0x6) returned 0x18a002e [0066.338] SaveDC (hdc=0x200107c4) returned 1 [0066.338] GetNearestColor (hdc=0x200107c4, color=0xf0f0f0) returned 0xf0f0f0 [0066.338] CreateSolidBrush (color=0xf0f0f0) returned 0x15100283 [0066.338] FillRect (hDC=0x200107c4, lprc=0x2ed128, hbr=0x15100283) returned 1 [0066.338] DeleteObject (ho=0x15100283) returned 1 [0066.338] RestoreDC (hdc=0x200107c4, nSavedDC=-1) returned 1 [0066.339] SetWindowLongPtrW (hWnd=0x50162, nIndex=-8, dwNewLong=0x4015c) returned 0x4015c [0066.339] SendMessageW (hWnd=0x4015c, Msg=0x80, wParam=0x1, lParam=0x900ff) returned 0x0 [0066.339] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x80, wParam=0x1, lParam=0x900ff) returned 0x0 [0066.340] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0xd, wParam=0x104, lParam=0x12648b0) returned 0x0 [0066.340] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0xd, wParam=0x104, lParam=0x12648b0) returned 0x0 [0066.341] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc4e0000 [0066.341] GetWindowLongPtrW (hWnd=0x50162, nIndex=-16) returned 0x16cf0000 [0066.341] GetWindowTextLengthW (hWnd=0x50162) returned 5 [0066.341] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.341] GetSystemMetrics (nIndex=42) returned 0 [0066.341] GetWindowTextW (in: hWnd=0x50162, lpString=0x2ee060, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.341] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xd, wParam=0x6, lParam=0x2ee060) returned 0x5 [0066.341] GetWindowTextLengthW (hWnd=0x50162) returned 5 [0066.341] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.341] GetSystemMetrics (nIndex=42) returned 0 [0066.341] GetWindowTextW (in: hWnd=0x50162, lpString=0x2ee060, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.341] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xd, wParam=0x6, lParam=0x2ee060) returned 0x5 [0066.341] GetWindowLongPtrW (hWnd=0x50162, nIndex=-16) returned 0x16cf0000 [0066.341] GetWindowLongPtrW (hWnd=0x50162, nIndex=-20) returned 0x90100 [0066.341] SetWindowLongPtrW (hWnd=0x50162, nIndex=-16, dwNewLong=0x12cf0000) returned 0x16cf0000 [0066.341] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2ee130) returned 0x0 [0066.342] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2ee130) returned 0x0 [0066.342] SetWindowLongPtrW (hWnd=0x50162, nIndex=-20, dwNewLong=0x90000) returned 0x90100 [0066.342] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2ee130) returned 0x0 [0066.342] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2ee130) returned 0x0 [0066.342] SetWindowPos (hWnd=0x50162, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0066.342] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x46, wParam=0x0, lParam=0x2ee180) returned 0x0 [0066.343] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x83, wParam=0x1, lParam=0x2ee150) returned 0x0 [0066.345] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0066.347] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2edd78 | out: lpwndpl=0x2edd78) returned 1 [0066.347] GetClientRect (in: hWnd=0x50162, lpRect=0x2edc90 | out: lpRect=0x2edc90) returned 1 [0066.347] GetWindowTextLengthW (hWnd=0x50162) returned 5 [0066.347] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0066.347] GetSystemMetrics (nIndex=42) returned 0 [0066.347] GetWindowTextW (in: hWnd=0x50162, lpString=0x2eda00, nMaxCount=6 | out: lpString="Form1") returned 5 [0066.347] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xd, wParam=0x6, lParam=0x2eda00) returned 0x5 [0066.347] GetClientRect (in: hWnd=0x50162, lpRect=0x2eda78 | out: lpRect=0x2eda78) returned 1 [0066.347] GetCurrentObject (hdc=0xc01027c, type=0x1) returned 0x1b00017 [0066.347] GetCurrentObject (hdc=0xc01027c, type=0x2) returned 0x1900010 [0066.347] GetCurrentObject (hdc=0xc01027c, type=0x7) returned 0x1c0501a0 [0066.347] GetCurrentObject (hdc=0xc01027c, type=0x6) returned 0x18a002e [0066.347] SaveDC (hdc=0xc01027c) returned 1 [0066.348] GetNearestColor (hdc=0xc01027c, color=0xf0f0f0) returned 0xf0f0f0 [0066.348] CreateSolidBrush (color=0xf0f0f0) returned 0x16100283 [0066.348] FillRect (hDC=0xc01027c, lprc=0x2ed768, hbr=0x16100283) returned 1 [0066.348] DeleteObject (ho=0x16100283) returned 1 [0066.348] RestoreDC (hdc=0xc01027c, nSavedDC=-1) returned 1 [0066.348] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2edd58 | out: lpwndpl=0x2edd58) returned 1 [0066.348] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x47, wParam=0x0, lParam=0x2ee180) returned 0x0 [0066.348] GetClientRect (in: hWnd=0x50162, lpRect=0x2edbf0 | out: lpRect=0x2edbf0) returned 1 [0066.348] GetWindowRect (in: hWnd=0x50162, lpRect=0x2edbf0 | out: lpRect=0x2edbf0) returned 1 [0066.349] RedrawWindow (hWnd=0x50162, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0066.349] GetSystemMenu (hWnd=0x50162, bRevert=0) returned 0x110183 [0066.349] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2ee1f8 | out: lpwndpl=0x2ee1f8) returned 1 [0066.349] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0066.349] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0066.349] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0066.349] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0066.349] EnableMenuItem (hMenu=0x110183, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0066.349] SetWindowLongPtrW (hWnd=0x50114, nIndex=-8, dwNewLong=0x50162) returned 0x30268 [0066.372] GetComputerNameW (in: lpBuffer=0x2eaf70, nSize=0x2eb298 | out: lpBuffer="XDUWTFONO", nSize=0x2eb298) returned 1 [0067.342] LocalAlloc (uFlags=0x0, uBytes=0x36) returned 0x9a5a50 [0071.118] ShellExecuteExW (in: pExecInfo=0x27f5258*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="vssadmin.exe", lpParameters="delete shadows /all /quiet", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x27f5258*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="vssadmin.exe", lpParameters="delete shadows /all /quiet", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x354)) returned 1 [0089.814] LocalFree (hMem=0x9a9ee0) returned 0x0 [0089.814] LocalFree (hMem=0x9a5a50) returned 0x0 [0090.305] GetLogicalDrives () returned 0x4 [0090.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee420) returned 1 [0090.741] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edf10, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0090.742] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edeb0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0090.779] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x9c0640 [0090.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0090.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0090.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0090.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0090.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0090.783] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0090.783] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0090.783] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0090.783] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0090.783] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe3107a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0090.783] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0090.784] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0090.784] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0090.784] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0090.784] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0090.785] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0090.785] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee110 | out: lpFindFileData=0x2ee110*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0090.785] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0090.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee370) returned 1 [0090.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0092.397] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK.enc", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK.enc", lpFilePart=0x0) returned 0x13 [0092.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2c0) returned 1 [0092.398] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.enc" (normalized: "c:\\bootsect.bak.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f8 [0092.489] GetFileType (hFile=0x2f8) returned 0x1 [0092.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0092.489] GetFileType (hFile=0x2f8) returned 0x1 [0093.109] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x2ee420 | out: pfEnabled=0x2ee420) returned 0x0 [0102.041] GetFullPathNameW (in: lpFileName="C:\\BOOTSECT.BAK", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\BOOTSECT.BAK", lpFilePart=0x0) returned 0xf [0102.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2c0) returned 1 [0102.041] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0102.129] EtwEventRegister (in: ProviderId=0x28fdfb8, EnableCallback=0x1ade13bc, CallbackContext=0x0, RegHandle=0x28fdf98 | out: RegHandle=0x28fdf98) returned 0x0 [0108.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eac00) returned 1 [0114.875] GetFullPathNameW (in: lpFileName="C:\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x1b [0114.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee250) returned 1 [0114.875] CreateFileW (lpFileName="C:\\Decrypt Instructions.txt" (normalized: "c:\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0114.878] GetFileType (hFile=0x320) returned 0x1 [0114.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1c0) returned 1 [0114.878] GetFileType (hFile=0x320) returned 0x1 [0116.554] WriteFile (in: hFile=0x320, lpBuffer=0x2903a88*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee2f8, lpOverlapped=0x0 | out: lpBuffer=0x2903a88*, lpNumberOfBytesWritten=0x2ee2f8*=0x77c, lpOverlapped=0x0) returned 1 [0116.555] CloseHandle (hObject=0x320) returned 1 [0116.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee480) returned 1 [0116.567] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edf70, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0116.567] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edf10, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0116.568] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x9c0640 [0116.569] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0116.569] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0116.569] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0116.569] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x856775b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x856775b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x856775b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK.enc", cAlternateFileName="BOOTSE~1.ENC")) returned 1 [0116.569] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0116.570] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926e5c10, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x926e5c10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9371d1f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.570] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0116.570] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0116.570] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0116.571] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0116.571] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0116.571] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe3107a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0116.571] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0116.571] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0116.571] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0116.572] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0116.572] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0116.572] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0116.572] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee170 | out: lpFindFileData=0x2ee170*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.572] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee3d0) returned 1 [0116.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee390) returned 1 [0116.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3d0) returned 1 [0116.573] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0116.573] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x2ede60, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0116.573] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.574] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.574] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0116.574] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0116.574] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee320) returned 1 [0116.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0116.575] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x28 [0116.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee200) returned 1 [0116.575] CreateFileW (lpFileName="C:\\$Recycle.Bin\\Decrypt Instructions.txt" (normalized: "c:\\$recycle.bin\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.616] GetFileType (hFile=0x320) returned 0x1 [0116.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee170) returned 1 [0116.616] GetFileType (hFile=0x320) returned 0x1 [0116.616] WriteFile (in: hFile=0x320, lpBuffer=0x290ada8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee2a8, lpOverlapped=0x0 | out: lpBuffer=0x290ada8*, lpNumberOfBytesWritten=0x2ee2a8*=0x77c, lpOverlapped=0x0) returned 1 [0116.617] CloseHandle (hObject=0x320) returned 1 [0116.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee430) returned 1 [0116.617] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x2edf20, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0116.617] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0116.618] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9378f610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9378f610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.618] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9378f610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9378f610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.618] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9378f610, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9378f610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9378f610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.618] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0116.618] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.619] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee380) returned 1 [0116.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee340) returned 1 [0116.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.619] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e [0116.619] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f [0116.619] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.620] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.620] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.620] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.620] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.621] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0116.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.621] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Decrypt Instructions.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.622] GetFileType (hFile=0x320) returned 0x1 [0116.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.622] GetFileType (hFile=0x320) returned 0x1 [0116.622] WriteFile (in: hFile=0x320, lpBuffer=0x2911618*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2911618*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.623] CloseHandle (hObject=0x320) returned 1 [0116.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.623] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e [0116.623] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f [0116.623] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9378f610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9378f610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.623] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9378f610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9378f610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.624] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9378f610, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9378f610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9378f610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.624] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0116.624] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0116.624] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3d0) returned 1 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0116.624] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x2ede60, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0116.624] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.625] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0116.625] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0116.626] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0116.626] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0116.626] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0116.626] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0116.627] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0116.627] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0116.627] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0116.627] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0116.627] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0116.627] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0116.628] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0116.628] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0116.628] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0116.628] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0116.628] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0116.628] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0116.629] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0116.630] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0116.630] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0116.630] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0116.630] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0116.630] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee320) returned 1 [0116.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0116.630] GetFullPathNameW (in: lpFileName="C:\\Boot\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x20 [0116.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee200) returned 1 [0116.631] CreateFileW (lpFileName="C:\\Boot\\Decrypt Instructions.txt" (normalized: "c:\\boot\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.631] GetFileType (hFile=0x320) returned 0x1 [0116.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee170) returned 1 [0116.631] GetFileType (hFile=0x320) returned 0x1 [0116.631] WriteFile (in: hFile=0x320, lpBuffer=0x29195f0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee2a8, lpOverlapped=0x0 | out: lpBuffer=0x29195f0*, lpNumberOfBytesWritten=0x2ee2a8*=0x77c, lpOverlapped=0x0) returned 1 [0116.632] CloseHandle (hObject=0x320) returned 1 [0116.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee430) returned 1 [0116.633] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x2edf20, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0116.633] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0116.633] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937b5770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937b5770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.633] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937b5770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937b5770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.633] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0116.633] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0116.633] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0116.634] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0116.634] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0116.634] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0116.634] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0116.634] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0116.634] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937b5770, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937b5770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937b5770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.634] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0116.635] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0116.636] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0116.637] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0116.637] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0116.637] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0116.637] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0116.637] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.637] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee380) returned 1 [0116.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee340) returned 1 [0116.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.637] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0116.637] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0116.638] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.639] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.639] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.639] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.639] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.639] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.640] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\Decrypt Instructions.txt" (normalized: "c:\\boot\\cs-cz\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.640] GetFileType (hFile=0x320) returned 0x1 [0116.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.640] GetFileType (hFile=0x320) returned 0x1 [0116.640] WriteFile (in: hFile=0x320, lpBuffer=0x2921658*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2921658*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.641] CloseHandle (hObject=0x320) returned 1 [0116.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.641] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0116.641] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0116.642] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937b5770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937b5770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.642] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937b5770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937b5770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.642] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.642] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937b5770, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937b5770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937b5770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.642] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937b5770, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937b5770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937b5770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.643] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.643] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0116.643] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0116.643] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.643] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.643] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.644] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.644] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.644] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.644] CreateFileW (lpFileName="C:\\Boot\\da-DK\\Decrypt Instructions.txt" (normalized: "c:\\boot\\da-dk\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.644] GetFileType (hFile=0x320) returned 0x1 [0116.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.644] GetFileType (hFile=0x320) returned 0x1 [0116.645] WriteFile (in: hFile=0x320, lpBuffer=0x2927768*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2927768*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.646] CloseHandle (hObject=0x320) returned 1 [0116.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.646] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0116.646] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0116.646] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.646] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.646] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.647] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937db8d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.647] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937db8d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.647] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.647] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0116.647] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0116.647] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.649] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.649] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.649] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.649] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.649] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.650] CreateFileW (lpFileName="C:\\Boot\\de-DE\\Decrypt Instructions.txt" (normalized: "c:\\boot\\de-de\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.650] GetFileType (hFile=0x320) returned 0x1 [0116.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.650] GetFileType (hFile=0x320) returned 0x1 [0116.650] WriteFile (in: hFile=0x320, lpBuffer=0x292d878*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x292d878*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.651] CloseHandle (hObject=0x320) returned 1 [0116.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.652] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0116.652] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0116.652] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.652] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.652] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.652] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937db8d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.652] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937db8d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.653] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.653] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0116.653] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0116.653] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.653] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.653] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.654] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.654] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.654] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.654] CreateFileW (lpFileName="C:\\Boot\\el-GR\\Decrypt Instructions.txt" (normalized: "c:\\boot\\el-gr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.654] GetFileType (hFile=0x320) returned 0x1 [0116.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.654] GetFileType (hFile=0x320) returned 0x1 [0116.655] WriteFile (in: hFile=0x320, lpBuffer=0x2933988*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2933988*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.656] CloseHandle (hObject=0x320) returned 1 [0116.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.656] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0116.656] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0116.656] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.656] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.656] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.657] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937db8d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.657] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937db8d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x937db8d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x937db8d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.657] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.657] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0116.657] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0116.657] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.659] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.659] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.659] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0116.659] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.659] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.660] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.660] CreateFileW (lpFileName="C:\\Boot\\en-US\\Decrypt Instructions.txt" (normalized: "c:\\boot\\en-us\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.662] WriteFile (in: hFile=0x320, lpBuffer=0x2939c88*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2939c88*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.664] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0116.664] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0116.664] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.664] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.664] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.664] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93801a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.664] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0116.665] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0116.665] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.665] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0116.665] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0116.665] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.666] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.666] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.666] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.666] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.667] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.667] CreateFileW (lpFileName="C:\\Boot\\es-ES\\Decrypt Instructions.txt" (normalized: "c:\\boot\\es-es\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.667] WriteFile (in: hFile=0x320, lpBuffer=0x293fec8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x293fec8*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.668] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0116.668] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0116.669] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.669] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.669] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.669] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93801a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.669] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93801a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.669] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.669] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0116.669] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0116.670] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.670] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.670] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.670] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.670] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.670] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.671] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\Decrypt Instructions.txt" (normalized: "c:\\boot\\fi-fi\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.671] WriteFile (in: hFile=0x320, lpBuffer=0x2945fd8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2945fd8*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.672] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0116.672] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0116.672] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.672] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.673] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.673] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93801a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.673] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93801a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93801a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93801a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.673] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.673] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0116.673] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0116.674] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0116.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0116.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0116.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0116.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0116.676] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.676] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.676] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.676] CreateFileW (lpFileName="C:\\Boot\\Fonts\\Decrypt Instructions.txt" (normalized: "c:\\boot\\fonts\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.678] WriteFile (in: hFile=0x320, lpBuffer=0x294c7d0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x294c7d0*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.679] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0116.679] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0116.679] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.679] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.679] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0116.680] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0116.680] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93827b90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.680] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0116.680] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0116.680] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0116.680] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0116.680] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.681] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0116.681] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0116.681] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.682] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.682] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.682] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.682] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.682] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.682] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\Decrypt Instructions.txt" (normalized: "c:\\boot\\fr-fr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.683] WriteFile (in: hFile=0x320, lpBuffer=0x2952cb8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2952cb8*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.684] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0116.684] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0116.684] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.685] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.685] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.685] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93827b90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.685] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93827b90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.685] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.685] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0116.686] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0116.686] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.686] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.686] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.686] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.686] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.686] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.687] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\Decrypt Instructions.txt" (normalized: "c:\\boot\\hu-hu\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.687] WriteFile (in: hFile=0x320, lpBuffer=0x2958dc8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x2958dc8*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0116.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.688] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0116.688] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0116.688] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.689] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.689] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.689] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93827b90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.689] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93827b90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93827b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93827b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.689] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.689] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0116.689] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0116.689] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.690] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.690] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.690] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.690] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.691] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.691] CreateFileW (lpFileName="C:\\Boot\\it-IT\\Decrypt Instructions.txt" (normalized: "c:\\boot\\it-it\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.693] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0116.693] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0116.693] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.693] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.693] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.693] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.693] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.693] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.693] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0116.693] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0116.693] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.694] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.694] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.694] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.694] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.694] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.694] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\Decrypt Instructions.txt" (normalized: "c:\\boot\\ja-jp\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.695] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0116.695] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0116.695] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.696] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.696] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.696] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.696] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.696] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.696] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0116.696] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0116.696] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.697] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.697] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.697] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.697] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.697] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.698] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\Decrypt Instructions.txt" (normalized: "c:\\boot\\ko-kr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.699] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0116.699] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0116.699] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.700] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.700] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.700] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.700] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.700] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.700] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0116.700] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0116.700] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.700] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.700] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.701] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.701] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.701] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.701] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\Decrypt Instructions.txt" (normalized: "c:\\boot\\nb-no\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.702] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0116.702] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0116.702] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.703] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.703] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.703] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.703] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9384dcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9384dcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9384dcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.703] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.703] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0116.703] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0116.703] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.704] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.704] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.704] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.704] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.704] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.705] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\Decrypt Instructions.txt" (normalized: "c:\\boot\\nl-nl\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.706] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0116.706] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0116.706] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.706] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.706] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.706] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.706] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.706] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.706] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0116.707] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0116.707] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.707] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.707] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.707] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.707] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.707] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.707] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\Decrypt Instructions.txt" (normalized: "c:\\boot\\pl-pl\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.709] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0116.709] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0116.709] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.709] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.709] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.710] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.710] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.710] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.710] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0116.710] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0116.710] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.711] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.711] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.711] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.711] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.711] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.711] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\Decrypt Instructions.txt" (normalized: "c:\\boot\\pt-br\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.713] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0116.713] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0116.713] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.713] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.713] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.713] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.713] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.713] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.714] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0116.714] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0116.714] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.714] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.714] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.714] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.714] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.714] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.715] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\Decrypt Instructions.txt" (normalized: "c:\\boot\\pt-pt\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.716] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0116.716] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0116.716] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.716] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.716] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.717] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.717] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.717] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.717] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0116.717] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0116.717] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.718] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.718] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.718] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.719] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.719] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.719] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\Decrypt Instructions.txt" (normalized: "c:\\boot\\ru-ru\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.721] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0116.721] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0116.721] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.721] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93873e50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.721] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.722] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.722] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93873e50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93873e50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.722] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.722] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0116.722] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0116.722] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.723] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.723] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.723] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.723] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.723] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.723] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\Decrypt Instructions.txt" (normalized: "c:\\boot\\sv-se\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.725] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0116.725] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0116.725] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.725] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.725] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.725] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93899fb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.726] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93899fb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.726] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.726] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0116.726] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0116.726] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.727] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.727] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.727] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.727] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.728] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.728] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\Decrypt Instructions.txt" (normalized: "c:\\boot\\tr-tr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.730] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0116.730] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0116.730] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.730] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93899fb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.730] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93899fb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.730] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.730] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0116.730] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0116.731] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.731] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.731] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.731] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.731] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.731] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.732] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\Decrypt Instructions.txt" (normalized: "c:\\boot\\zh-cn\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.733] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0116.733] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0116.733] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.734] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.734] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.734] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93899fb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.734] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93899fb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x93899fb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x93899fb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.734] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.734] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0116.734] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0116.734] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.736] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.736] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.736] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0116.736] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.736] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.736] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\Decrypt Instructions.txt" (normalized: "c:\\boot\\zh-hk\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0116.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.738] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0116.738] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0116.738] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x938c0110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x938c0110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.738] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x938c0110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x938c0110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.738] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.738] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938c0110, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x938c0110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x938c0110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0116.738] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938c0110, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x938c0110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x938c0110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0116.739] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0116.739] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0116.739] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0116.739] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.739] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0116.739] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0116.740] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0116.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0116.740] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0116.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0116.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0116.743] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0116.743] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0116.743] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x938c0110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x938c0110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.743] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0116.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0116.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3d0) returned 1 [0116.743] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0116.743] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x2ede60, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0116.743] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.744] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee320) returned 1 [0116.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0116.744] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x26 [0116.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee200) returned 1 [0116.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee170) returned 1 [0116.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee430) returned 1 [0116.746] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x2edf20, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0116.746] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0116.746] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x938c0110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x938c0110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0116.747] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0116.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee380) returned 1 [0116.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee340) returned 1 [0116.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3d0) returned 1 [0116.747] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0116.747] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\", nBufferLength=0x105, lpBuffer=0x2ede60, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\", lpFilePart=0x0) returned 0x1a [0116.747] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0116.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee300) returned 1 [0121.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee430) returned 1 [0121.476] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x2edf20, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0121.476] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\", lpFilePart=0x0) returned 0x1a [0121.476] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0121.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee360) returned 1 [0121.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3d0) returned 1 [0121.482] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0121.482] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x2ede60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0121.482] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.483] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.483] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0121.483] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0121.484] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee320) returned 1 [0121.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0121.484] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x24 [0121.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee200) returned 1 [0121.484] CreateFileW (lpFileName="C:\\MSOCache\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0121.485] GetFileType (hFile=0x320) returned 0x1 [0121.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee170) returned 1 [0121.486] GetFileType (hFile=0x320) returned 0x1 [0121.486] WriteFile (in: hFile=0x320, lpBuffer=0x29bbb38*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee2a8, lpOverlapped=0x0 | out: lpBuffer=0x29bbb38*, lpNumberOfBytesWritten=0x2ee2a8*=0x77c, lpOverlapped=0x0) returned 1 [0121.488] CloseHandle (hObject=0x320) returned 1 [0121.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee430) returned 1 [0121.489] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x2edf20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0121.489] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0121.489] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x965fa310, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x965fa310, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.489] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x965fa310, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x965fa310, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.489] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0121.490] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x965fa310, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x965fa310, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x965fa310, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0121.490] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x965fa310, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x965fa310, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x965fa310, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0121.490] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee380) returned 1 [0121.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee340) returned 1 [0121.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0121.490] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0121.491] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0121.491] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.511] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.544] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0121.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0121.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0121.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0121.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0121.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0121.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0121.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0121.546] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0121.546] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0121.546] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0121.546] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0121.546] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0121.547] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0121.547] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0121.547] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0121.547] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0121.547] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0121.547] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0121.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0121.548] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x2e [0121.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0121.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0121.550] GetFileType (hFile=0x320) returned 0x1 [0121.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0121.550] GetFileType (hFile=0x320) returned 0x1 [0121.550] WriteFile (in: hFile=0x320, lpBuffer=0x29c3d68*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x29c3d68*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0121.551] CloseHandle (hObject=0x320) returned 1 [0121.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0121.551] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0121.551] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0121.551] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96692890, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96692890, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.552] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96692890, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96692890, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.552] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96692890, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x96692890, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96692890, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0121.552] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0121.552] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0121.552] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0121.552] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0121.553] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0121.554] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0121.554] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0121.554] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0121.554] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0121.554] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0121.554] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0121.554] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.554] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0121.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0121.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0121.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0121.555] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0121.555] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.558] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.558] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0121.558] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0121.558] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0121.559] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.559] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.559] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0121.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0121.559] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0121.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0121.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0121.608] GetFileType (hFile=0x320) returned 0x1 [0121.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0121.608] GetFileType (hFile=0x320) returned 0x1 [0121.608] WriteFile (in: hFile=0x320, lpBuffer=0x29cd4a0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x29cd4a0*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0121.609] CloseHandle (hObject=0x320) returned 1 [0121.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0121.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0121.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0121.609] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9672ae10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9672ae10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.609] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9672ae10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9672ae10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.610] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x966b89f0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x966b89f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9672ae10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0121.610] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0121.610] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0121.610] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0121.610] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.611] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.611] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0121.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0121.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0121.611] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0121.611] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0121.611] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.928] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.928] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0121.928] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0121.928] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0121.928] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.928] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.929] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0121.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0121.929] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0121.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0121.930] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0121.931] GetFileType (hFile=0x320) returned 0x1 [0121.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0121.931] GetFileType (hFile=0x320) returned 0x1 [0121.931] WriteFile (in: hFile=0x320, lpBuffer=0x29d4f10*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x29d4f10*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0121.932] CloseHandle (hObject=0x320) returned 1 [0121.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0121.932] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0121.932] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0121.932] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96a4aaf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96a4aaf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0121.933] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96a4aaf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96a4aaf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.933] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96a4aaf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x96a4aaf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96a4aaf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0121.933] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0121.933] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0121.933] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0121.933] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.934] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.934] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0121.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0121.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0121.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0121.934] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0121.934] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0121.934] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0122.001] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.002] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0122.002] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0122.002] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0122.002] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0122.002] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.002] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0122.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0122.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0122.003] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0122.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0122.003] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0122.005] GetFileType (hFile=0x320) returned 0x1 [0122.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0122.005] GetFileType (hFile=0x320) returned 0x1 [0122.005] WriteFile (in: hFile=0x320, lpBuffer=0x29dca20*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x29dca20*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0122.006] CloseHandle (hObject=0x320) returned 1 [0122.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0122.006] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0122.006] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0122.007] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96ae3070, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96ae3070, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0122.007] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96ae3070, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96ae3070, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.007] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96ae3070, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x96ae3070, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96ae3070, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0122.007] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0122.007] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0122.008] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0122.008] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0122.008] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0122.008] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0122.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0122.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0122.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0122.009] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0122.009] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0122.009] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0122.093] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.093] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0122.093] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0122.093] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0122.093] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0122.093] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.094] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0122.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0122.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0122.095] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0122.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0122.095] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0122.096] GetFileType (hFile=0x320) returned 0x1 [0122.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0122.097] GetFileType (hFile=0x320) returned 0x1 [0122.097] WriteFile (in: hFile=0x320, lpBuffer=0x29e4500*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x29e4500*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0122.098] CloseHandle (hObject=0x320) returned 1 [0122.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0122.098] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0122.098] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0122.098] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96bc78b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96bc78b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0122.099] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x96bc78b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96bc78b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.099] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96bc78b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x96bc78b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x96bc78b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0122.099] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0122.099] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0122.100] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0122.100] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0122.100] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0122.100] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0122.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0122.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0122.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0122.100] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0122.100] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0122.100] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0122.356] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.356] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0122.356] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0122.357] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0122.357] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0122.357] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.357] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0122.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0122.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0122.358] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0122.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0122.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0123.997] GetFileType (hFile=0x320) returned 0x1 [0123.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0123.997] GetFileType (hFile=0x320) returned 0x1 [0124.110] WriteFile (in: hFile=0x320, lpBuffer=0x27f6080*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x27f6080*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0124.114] CloseHandle (hObject=0x320) returned 1 [0124.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0124.115] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0124.115] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0124.115] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97dc7f10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97dc7f10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.115] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97dc7f10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97dc7f10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.115] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x96e4f010, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x96e4f010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97ef8a10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0124.115] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.116] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0124.116] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0124.116] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0124.116] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0124.116] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0124.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0124.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0124.117] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0124.117] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0124.117] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.138] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.139] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0124.139] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0124.139] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0124.139] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0124.139] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0124.139] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.140] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.141] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0124.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0124.141] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0124.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0124.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0124.143] GetFileType (hFile=0x320) returned 0x1 [0124.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0124.143] GetFileType (hFile=0x320) returned 0x1 [0124.143] WriteFile (in: hFile=0x320, lpBuffer=0x27fdcb8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x27fdcb8*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0124.144] CloseHandle (hObject=0x320) returned 1 [0124.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0124.145] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0124.145] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0124.145] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f1eb70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f1eb70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.145] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f1eb70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f1eb70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.145] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97f1eb70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x97f1eb70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f1eb70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0124.145] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0124.145] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0124.146] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0124.146] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0124.146] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0124.146] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.146] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0124.146] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0124.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0124.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0124.147] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0124.147] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0124.147] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.147] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.147] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0124.148] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0124.148] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0124.148] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.148] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0124.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0124.148] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x60 [0124.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0124.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0124.149] GetFileType (hFile=0x320) returned 0x1 [0124.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0124.149] GetFileType (hFile=0x320) returned 0x1 [0124.149] WriteFile (in: hFile=0x320, lpBuffer=0x28059e8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x28059e8*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0124.150] CloseHandle (hObject=0x320) returned 1 [0124.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0124.150] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0124.150] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0124.150] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f44cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f44cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.151] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f44cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f44cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.151] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97f44cd0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x97f44cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f44cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0124.151] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0124.151] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0124.151] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0124.152] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0124.152] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0124.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0124.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0124.152] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0124.152] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0124.152] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.154] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.154] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0124.154] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0124.154] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0124.154] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.155] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0124.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0124.155] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x60 [0124.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0124.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0124.155] GetFileType (hFile=0x320) returned 0x1 [0124.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0124.155] GetFileType (hFile=0x320) returned 0x1 [0124.156] WriteFile (in: hFile=0x320, lpBuffer=0x280d240*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x280d240*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0124.157] CloseHandle (hObject=0x320) returned 1 [0124.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0124.157] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0124.157] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0124.157] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f44cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f44cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.157] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f44cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f44cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.157] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97f44cd0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x97f44cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f44cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0124.157] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0124.158] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0124.158] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0124.158] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0124.158] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0124.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0124.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0124.158] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0124.158] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0124.158] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.159] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.159] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0124.159] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0124.159] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0124.159] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.159] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0124.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0124.163] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x60 [0124.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0124.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0124.164] GetFileType (hFile=0x320) returned 0x1 [0124.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0124.164] GetFileType (hFile=0x320) returned 0x1 [0124.164] WriteFile (in: hFile=0x320, lpBuffer=0x2814a98*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x2814a98*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0124.165] CloseHandle (hObject=0x320) returned 1 [0124.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0124.165] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0124.165] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0124.166] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f6ae30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f6ae30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.166] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x97f6ae30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f6ae30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.166] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x97f6ae30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x97f6ae30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x97f6ae30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0124.166] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0124.167] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0124.167] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0124.167] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0124.167] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0124.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0124.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0124.167] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0124.167] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0124.167] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.500] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.953] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0124.953] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0124.954] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0124.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0124.956] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0124.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0124.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0124.958] GetFileType (hFile=0x320) returned 0x1 [0124.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0124.958] GetFileType (hFile=0x320) returned 0x1 [0124.958] WriteFile (in: hFile=0x320, lpBuffer=0x281c488*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x281c488*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0124.960] CloseHandle (hObject=0x320) returned 1 [0124.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0124.960] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0124.960] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0124.960] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x986db2f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x986db2f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0124.961] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x986db2f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x986db2f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.961] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x986db2f0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x986db2f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x986db2f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0124.961] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0124.962] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0124.962] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0124.962] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0124.963] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0124.963] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0124.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0124.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0124.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0124.963] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0124.963] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0124.963] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0125.845] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.845] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0125.845] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0125.845] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0125.846] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0125.846] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.846] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0125.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0125.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0125.926] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0125.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0125.926] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0125.928] GetFileType (hFile=0x320) returned 0x1 [0125.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0125.928] GetFileType (hFile=0x320) returned 0x1 [0125.928] WriteFile (in: hFile=0x320, lpBuffer=0x2823f60*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x2823f60*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0125.930] CloseHandle (hObject=0x320) returned 1 [0125.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0125.930] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0125.931] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0125.931] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99014830, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99014830, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0125.931] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99014830, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99014830, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.931] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99014830, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x99014830, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99014830, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0125.932] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0125.932] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0125.932] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0125.932] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0125.933] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0125.933] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0125.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0125.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0125.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0125.933] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0125.933] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0125.933] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0125.934] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0125.934] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0125.934] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0125.935] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0125.935] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0125.935] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0125.935] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0125.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0125.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0125.935] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0125.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0125.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.410] GetFileType (hFile=0x320) returned 0x1 [0126.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0126.410] GetFileType (hFile=0x320) returned 0x1 [0126.411] WriteFile (in: hFile=0x320, lpBuffer=0x282b9a0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x282b9a0*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0126.412] CloseHandle (hObject=0x320) returned 1 [0126.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0126.413] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.413] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.413] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x994b12d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x994b12d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.413] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x994b12d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x994b12d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.413] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99014830, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x99014830, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x994b12d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.413] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0126.414] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0126.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0126.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0126.415] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.415] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.415] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.437] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0126.437] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.438] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.438] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0126.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0126.439] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0126.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0126.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.441] GetFileType (hFile=0x320) returned 0x1 [0126.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0126.441] GetFileType (hFile=0x320) returned 0x1 [0126.441] WriteFile (in: hFile=0x320, lpBuffer=0x28333e8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x28333e8*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0126.442] CloseHandle (hObject=0x320) returned 1 [0126.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0126.443] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.443] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.443] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x994fd590, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x994fd590, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.443] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x994fd590, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x994fd590, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.443] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x994fd590, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x994fd590, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x994fd590, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.444] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0126.444] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0126.444] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0126.444] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.444] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0126.444] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0126.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0126.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0126.445] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.445] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.445] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.469] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.470] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0126.470] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0126.470] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0126.470] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.470] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.470] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0126.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0126.471] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0126.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0126.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.473] GetFileType (hFile=0x320) returned 0x1 [0126.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0126.473] GetFileType (hFile=0x320) returned 0x1 [0126.473] WriteFile (in: hFile=0x320, lpBuffer=0x283aeb8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x283aeb8*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0126.474] CloseHandle (hObject=0x320) returned 1 [0126.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0126.474] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.474] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.474] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x99549850, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99549850, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.475] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x99549850, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99549850, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.475] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99549850, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x99549850, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99549850, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.475] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0126.475] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0126.475] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0126.475] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.476] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0126.476] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0126.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0126.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0126.476] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.476] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.476] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.482] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.482] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0126.482] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0126.483] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0126.484] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.484] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.484] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0126.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0126.486] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0126.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0126.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.489] GetFileType (hFile=0x320) returned 0x1 [0126.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0126.489] GetFileType (hFile=0x320) returned 0x1 [0126.489] WriteFile (in: hFile=0x320, lpBuffer=0x2842990*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x2842990*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0126.492] CloseHandle (hObject=0x320) returned 1 [0126.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0126.493] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.493] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.493] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9956f9b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9956f9b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.493] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9956f9b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9956f9b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.494] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9956f9b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9956f9b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9956f9b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.494] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0126.494] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0126.495] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0126.495] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.495] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0126.495] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0126.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0126.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0126.496] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.496] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.496] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.523] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.523] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0126.523] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0126.524] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0126.524] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0126.524] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0126.524] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0126.524] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0126.525] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0126.525] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0126.525] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0126.525] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0126.526] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0126.526] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0126.526] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0126.526] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0126.527] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.527] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0126.527] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.527] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0126.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0126.529] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0126.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0126.529] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.531] GetFileType (hFile=0x320) returned 0x1 [0126.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0126.532] GetFileType (hFile=0x320) returned 0x1 [0126.532] WriteFile (in: hFile=0x320, lpBuffer=0x284c4d0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x284c4d0*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0126.534] CloseHandle (hObject=0x320) returned 1 [0126.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0126.534] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.534] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.535] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x995bbc70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x995bbc70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.535] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x995bbc70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x995bbc70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.535] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0126.536] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0126.536] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x995bbc70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x995bbc70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x995e1dd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.536] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0126.536] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0126.537] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0126.537] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0126.537] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0126.539] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0126.539] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0126.539] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0126.540] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0126.540] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0126.540] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0126.541] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0126.541] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0126.541] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.541] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0126.542] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0126.542] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0126.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0126.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0126.542] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0126.542] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0126.543] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.544] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0126.545] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.545] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0126.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0126.546] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x5c [0126.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0126.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.547] GetFileType (hFile=0x320) returned 0x1 [0126.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0126.547] GetFileType (hFile=0x320) returned 0x1 [0126.547] WriteFile (in: hFile=0x320, lpBuffer=0x28550b8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x28550b8*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0126.549] CloseHandle (hObject=0x320) returned 1 [0126.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0126.550] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0126.550] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0126.550] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x995e1dd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x995e1dd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.550] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x995e1dd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x995e1dd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.551] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x995e1dd0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x995e1dd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99607f30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.551] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0126.551] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0126.552] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0126.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0126.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0126.552] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.552] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.552] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.573] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.573] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0126.573] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0126.573] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0126.574] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.574] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.574] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0126.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0126.576] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0126.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0126.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.579] GetFileType (hFile=0x320) returned 0x1 [0126.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0126.580] WriteFile (in: hFile=0x320, lpBuffer=0x285c630*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x285c630*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0126.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0126.583] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.583] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.584] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9962e090, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9962e090, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.584] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9962e090, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9962e090, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.584] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0126.584] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0126.585] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0126.585] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9962e090, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9962e090, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x996541f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.585] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.585] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0126.586] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0126.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0126.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0126.586] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0126.586] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0126.586] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.676] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0126.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0126.677] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x64 [0126.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0126.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0126.679] WriteFile (in: hFile=0x320, lpBuffer=0x2864440*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x2864440*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0126.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0126.680] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0126.680] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0126.681] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99738a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99738a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.681] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99738a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99738a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.681] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0126.681] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0126.681] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0126.681] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0126.682] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99738a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x99738a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99738a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.682] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99738a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x99738a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x99738a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0126.682] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0126.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0126.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0126.682] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.682] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.682] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.746] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.746] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0126.746] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0126.747] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0126.748] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0126.748] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0126.748] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.748] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.748] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0126.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0126.749] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0126.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0126.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0126.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0126.752] WriteFile (in: hFile=0x320, lpBuffer=0x286d938*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x286d938*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0126.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0126.779] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.779] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.779] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x997f7110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x997f7110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0126.780] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x997f7110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x997f7110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.780] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x997f7110, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x997f7110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9981d270, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0126.780] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0126.780] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0126.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0126.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0126.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0126.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0126.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0126.781] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0126.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0126.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0126.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0126.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0126.782] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0126.783] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0126.783] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0126.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0126.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0126.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0126.783] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0126.783] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0126.783] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.082] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.094] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0128.094] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0128.094] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0128.095] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0128.096] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.096] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0128.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0128.097] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0128.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0128.097] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0128.099] WriteFile (in: hFile=0x320, lpBuffer=0x28779b0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x28779b0*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0128.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0128.100] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0128.100] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0128.100] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x9a4c2750, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a4c2750, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.101] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x9a4c2750, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a4c2750, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.101] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a4c2750, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a4c2750, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a4c2750, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.101] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0128.101] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0128.101] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0128.101] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0128.102] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0128.103] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0128.103] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0128.103] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0128.103] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0128.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0128.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0128.103] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0128.103] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0128.104] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.322] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.322] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0128.323] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0128.324] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0128.324] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0128.324] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0128.324] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0128.324] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.324] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0128.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0128.325] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0128.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0128.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Decrypt Instructions.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0128.337] WriteFile (in: hFile=0x320, lpBuffer=0x28817e0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x28817e0*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0128.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0128.339] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0128.339] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0128.339] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9a6fdbf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a6fdbf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.340] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x9a6fdbf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a6fdbf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9a6fdbf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a6fdbf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a6fdbf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0128.340] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0128.341] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0128.342] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0128.342] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0128.342] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0128.342] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0128.342] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0128.342] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0128.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0128.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3d0) returned 1 [0128.343] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0128.343] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x2ede60, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0128.343] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.343] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.344] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0128.344] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0128.344] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee320) returned 1 [0128.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0128.344] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x24 [0128.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee200) returned 1 [0128.344] CreateFileW (lpFileName="C:\\PerfLogs\\Decrypt Instructions.txt" (normalized: "c:\\perflogs\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee170) returned 1 [0128.345] WriteFile (in: hFile=0x320, lpBuffer=0x28891b0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee2a8, lpOverlapped=0x0 | out: lpBuffer=0x28891b0*, lpNumberOfBytesWritten=0x2ee2a8*=0x77c, lpOverlapped=0x0) returned 1 [0128.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee430) returned 1 [0128.347] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x2edf20, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0128.347] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0128.347] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.347] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.347] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0128.348] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a723d50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.348] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a723d50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0128.348] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee380) returned 1 [0128.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee340) returned 1 [0128.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0128.348] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0128.348] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0128.348] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.349] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.349] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0128.349] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0128.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0128.349] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x2a [0128.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0128.349] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\Decrypt Instructions.txt" (normalized: "c:\\perflogs\\admin\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0128.355] WriteFile (in: hFile=0x320, lpBuffer=0x288f128*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x288f128*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0128.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0128.356] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0128.356] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0128.356] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.357] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.357] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a723d50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.357] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a723d50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a723d50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a723d50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0128.357] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0128.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0128.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3d0) returned 1 [0128.358] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0128.358] GetFullPathNameW (in: lpFileName="C:\\Program Files\\", nBufferLength=0x105, lpBuffer=0x2ede60, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\", lpFilePart=0x0) returned 0x11 [0128.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe3107a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.358] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe3107a20, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe3107a20, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.358] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbfaa260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfaa260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0128.359] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.359] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbfd03c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfd03c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0128.359] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0128.359] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc446d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc446d00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0128.359] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0128.359] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdae682e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdae682e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0128.360] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc388620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc388620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0128.360] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc5053e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc5053e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0128.360] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc01c680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc01c680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0128.360] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc5053e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc5053e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0128.360] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdad83aa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdad83aa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0128.361] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbfaa260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfaa260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0128.361] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0128.361] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0128.361] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0128.361] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbff6520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbff6520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0128.362] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc420ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc420ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0128.362] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc0427e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc0427e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0128.362] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0128.362] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0c0 | out: lpFindFileData=0x2ee0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0128.362] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee320) returned 1 [0128.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0128.363] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x29 [0128.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee200) returned 1 [0128.363] CreateFileW (lpFileName="C:\\Program Files\\Decrypt Instructions.txt" (normalized: "c:\\program files\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee170) returned 1 [0128.364] WriteFile (in: hFile=0x320, lpBuffer=0x2896c50*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee2a8, lpOverlapped=0x0 | out: lpBuffer=0x2896c50*, lpNumberOfBytesWritten=0x2ee2a8*=0x77c, lpOverlapped=0x0) returned 1 [0128.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee430) returned 1 [0128.365] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x2edf20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0128.365] GetFullPathNameW (in: lpFileName="C:\\Program Files\\", nBufferLength=0x105, lpBuffer=0x2edec0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\", lpFilePart=0x0) returned 0x11 [0128.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a749eb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a749eb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.366] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a749eb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a749eb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.366] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbfaa260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfaa260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0128.366] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a749eb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a749eb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a749eb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.366] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0128.366] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbfd03c0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfd03c0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0128.366] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdc446d00, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc446d00, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdbf84100, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbf84100, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdae682e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdae682e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc388620, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc388620, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdc5053e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc5053e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc01c680, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc01c680, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc5053e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc5053e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0128.367] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xdad83aa0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdad83aa0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0128.368] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdbfaa260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfaa260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0128.368] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0128.368] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0128.368] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc4b9120, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc4b9120, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0128.368] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbff6520, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbff6520, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0128.368] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc420ba0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc420ba0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0128.369] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xdc0427e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdc0427e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0128.369] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0128.369] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee120 | out: lpFindFileData=0x2ee120*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.369] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee380) returned 1 [0128.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee340) returned 1 [0128.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee380) returned 1 [0128.369] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files", lpFilePart=0x0) returned 0x1d [0128.369] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\", nBufferLength=0x105, lpBuffer=0x2ede10, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\", lpFilePart=0x0) returned 0x1e [0128.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbfaa260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfaa260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.370] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdbfaa260, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdbfaa260, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.370] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3375a0, ftCreationTime.dwHighDateTime=0x1d5d2cc, ftLastAccessTime.dwLowDateTime=0x1b33e450, ftLastAccessTime.dwHighDateTime=0x1d5af14, ftLastWriteTime.dwLowDateTime=0x1b33e450, ftLastWriteTime.dwHighDateTime=0x1d5af14, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bitkinex.exe", cAlternateFileName="")) returned 1 [0128.370] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0128.370] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0128.370] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0128.370] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0128.371] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0128.371] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee070 | out: lpFindFileData=0x2ee070*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0128.371] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2d0) returned 1 [0128.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0128.371] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x36 [0128.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee1b0) returned 1 [0128.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee120) returned 1 [0128.372] WriteFile (in: hFile=0x320, lpBuffer=0x289f888*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee258, lpOverlapped=0x0 | out: lpBuffer=0x289f888*, lpNumberOfBytesWritten=0x2ee258*=0x77c, lpOverlapped=0x0) returned 1 [0128.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee3e0) returned 1 [0128.375] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files", nBufferLength=0x105, lpBuffer=0x2eded0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files", lpFilePart=0x0) returned 0x1d [0128.375] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\", nBufferLength=0x105, lpBuffer=0x2ede70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\", lpFilePart=0x0) returned 0x1e [0128.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a749eb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a749eb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.375] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a749eb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a749eb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.375] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3375a0, ftCreationTime.dwHighDateTime=0x1d5d2cc, ftLastAccessTime.dwLowDateTime=0x1b33e450, ftLastAccessTime.dwHighDateTime=0x1d5af14, ftLastWriteTime.dwLowDateTime=0x1b33e450, ftLastWriteTime.dwHighDateTime=0x1d5af14, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bitkinex.exe", cAlternateFileName="")) returned 1 [0128.375] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a749eb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a749eb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a770010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.376] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0128.376] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0128.376] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0128.376] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0128.376] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0128.376] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee0d0 | out: lpFindFileData=0x2ee0d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.376] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee330) returned 1 [0128.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2f0) returned 1 [0128.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0128.377] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER", lpFilePart=0x0) returned 0x26 [0128.377] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER\\", lpFilePart=0x0) returned 0x27 [0128.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.378] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.378] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0128.378] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.378] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0128.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0128.379] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x3f [0128.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0128.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\designer\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0128.379] WriteFile (in: hFile=0x320, lpBuffer=0x28a66b8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee208, lpOverlapped=0x0 | out: lpBuffer=0x28a66b8*, lpNumberOfBytesWritten=0x2ee208*=0x77c, lpOverlapped=0x0) returned 1 [0128.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0128.381] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER", lpFilePart=0x0) returned 0x26 [0128.381] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\DESIGNER\\", lpFilePart=0x0) returned 0x27 [0128.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9a770010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a770010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.381] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9a770010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a770010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.381] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a770010, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a770010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a770010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.382] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0128.382] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0128.382] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0128.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0128.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee330) returned 1 [0128.382] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared", lpFilePart=0x0) returned 0x2e [0128.382] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\", nBufferLength=0x105, lpBuffer=0x2eddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpFilePart=0x0) returned 0x2f [0128.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.383] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0128.383] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0128.384] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0128.385] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0128.386] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0128.386] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0128.386] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0128.386] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0128.386] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0128.386] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0128.386] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0128.387] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0128.387] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0128.387] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0128.387] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee020 | out: lpFindFileData=0x2ee020*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0128.388] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee280) returned 1 [0128.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0128.388] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x47 [0128.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee160) returned 1 [0128.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0d0) returned 1 [0128.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee390) returned 1 [0128.391] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared", nBufferLength=0x105, lpBuffer=0x2ede80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared", lpFilePart=0x0) returned 0x2e [0128.393] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\", nBufferLength=0x105, lpBuffer=0x2ede20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\", lpFilePart=0x0) returned 0x2f [0128.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a770010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a770010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9a770010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a770010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a770010, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a770010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a770010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0128.393] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0128.394] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0128.395] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0128.395] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0128.395] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0128.395] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee080 | out: lpFindFileData=0x2ee080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.395] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2e0) returned 1 [0128.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee2a0) returned 1 [0128.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0128.395] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\DW", lpFilePart=0x0) returned 0x31 [0128.395] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpFilePart=0x0) returned 0x32 [0128.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.559] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.559] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0128.559] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0128.559] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0128.559] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.559] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0128.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0128.560] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4a [0128.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0128.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0128.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0128.562] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\DW", lpFilePart=0x0) returned 0x31 [0128.562] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", lpFilePart=0x0) returned 0x32 [0128.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9a912f30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a912f30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.562] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9a912f30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a912f30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.562] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0128.562] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a912f30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9a912f30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9a939090, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.562] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0128.562] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0128.562] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0128.563] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0128.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0128.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0128.563] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", lpFilePart=0x0) returned 0x37 [0128.563] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpFilePart=0x0) returned 0x38 [0128.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.566] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.566] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0128.592] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0128.648] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0128.649] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0128.650] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0128.651] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0128.658] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.658] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0128.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0128.672] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x50 [0128.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0128.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.675] GetFileType (hFile=0x320) returned 0x1 [0128.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0128.675] GetFileType (hFile=0x320) returned 0x1 [0128.675] WriteFile (in: hFile=0x320, lpBuffer=0x28c0a60*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x28c0a60*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0128.677] CloseHandle (hObject=0x320) returned 1 [0128.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0128.677] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION", lpFilePart=0x0) returned 0x37 [0128.677] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", lpFilePart=0x0) returned 0x38 [0128.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aa43a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa43a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.678] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aa43a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa43a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.678] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0128.678] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa43a30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9aa43a30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa43a30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.678] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0128.678] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0128.679] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0128.679] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0128.679] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0128.679] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0128.679] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0128.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0128.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0128.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", lpFilePart=0x0) returned 0x3c [0128.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpFilePart=0x0) returned 0x3d [0128.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.687] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.688] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0128.688] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.688] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0128.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0128.688] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x55 [0128.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0128.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.689] GetFileType (hFile=0x320) returned 0x1 [0128.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0128.689] GetFileType (hFile=0x320) returned 0x1 [0128.689] WriteFile (in: hFile=0x320, lpBuffer=0x28c7f98*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x28c7f98*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0128.691] CloseHandle (hObject=0x320) returned 1 [0128.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0128.691] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033", lpFilePart=0x0) returned 0x3c [0128.691] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", lpFilePart=0x0) returned 0x3d [0128.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aa69b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa69b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.691] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x9aa69b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa69b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.692] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa69b90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9aa69b90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa69b90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.692] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0128.692] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0128.692] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0128.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0128.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0128.693] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", lpFilePart=0x0) returned 0x33 [0128.693] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpFilePart=0x0) returned 0x34 [0128.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.696] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.696] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0128.697] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.697] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0128.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0128.697] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4c [0128.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0128.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.704] GetFileType (hFile=0x320) returned 0x1 [0128.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0128.704] GetFileType (hFile=0x320) returned 0x1 [0128.705] WriteFile (in: hFile=0x320, lpBuffer=0x28ceb10*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x28ceb10*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0128.706] CloseHandle (hObject=0x320) returned 1 [0128.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0128.707] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO", lpFilePart=0x0) returned 0x33 [0128.707] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", lpFilePart=0x0) returned 0x34 [0128.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9aa8fcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa8fcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.707] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9aa8fcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa8fcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.708] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa8fcf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9aa8fcf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9aa8fcf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.708] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0128.708] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0128.708] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0128.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0128.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0128.708] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpFilePart=0x0) returned 0x36 [0128.709] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpFilePart=0x0) returned 0x37 [0128.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.749] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.749] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0128.749] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0128.749] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0128.749] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0128.749] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.750] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0128.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0128.750] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4f [0128.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0128.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0128.751] GetFileType (hFile=0x320) returned 0x1 [0128.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0128.751] GetFileType (hFile=0x320) returned 0x1 [0128.751] WriteFile (in: hFile=0x320, lpBuffer=0x28d5c98*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x28d5c98*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0128.752] CloseHandle (hObject=0x320) returned 1 [0128.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0128.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters", lpFilePart=0x0) returned 0x36 [0128.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", lpFilePart=0x0) returned 0x37 [0128.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9ab02110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9ab02110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.753] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9ab02110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9ab02110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.754] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab02110, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9ab02110, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9ab02110, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0128.754] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0128.754] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0128.754] FindNextFileW (in: hFindFile=0x9c0640, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0128.755] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0128.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0128.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0128.756] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", lpFilePart=0x0) returned 0x36 [0128.756] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpFilePart=0x0) returned 0x37 [0128.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0640 [0128.769] FindClose (in: hFindFile=0x9c0640 | out: hFindFile=0x9c0640) returned 1 [0128.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0128.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0128.772] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.enc", lpFilePart=0x0) returned 0x47 [0128.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0128.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0128.774] GetFileType (hFile=0x320) returned 0x1 [0128.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0128.774] GetFileType (hFile=0x320) returned 0x1 [0134.034] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpFilePart=0x0) returned 0x43 [0134.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0134.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0134.072] GetFileType (hFile=0x34c) returned 0x1 [0134.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0134.072] GetFileType (hFile=0x34c) returned 0x1 [0134.076] ReadFile (in: hFile=0x34c, lpBuffer=0x127e2168, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x127e2168*, lpNumberOfBytesRead=0x2ee2b8*=0x1a9b, lpOverlapped=0x0) returned 1 [0134.549] GetCurrentActCtx (in: lphActCtx=0x2ee2e0 | out: lphActCtx=0x2ee2e0*=0x963ea8) returned 1 [0134.554] OleInitialize (pvReserved=0x0) returned 0x0 [0134.556] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x2ee298 | out: lplpMessageFilter=0x2ee298*=0x0) returned 0x0 [0134.560] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 1 [0134.560] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.560] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.561] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.562] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.563] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0134.564] PeekMessageW (in: lpMsg=0x27d60f8, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x27d60f8) returned 1 [0134.564] IsWindowUnicode (hWnd=0x50162) returned 1 [0134.565] GetMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x2ee230) returned 1 [0134.570] TranslateMessage (lpMsg=0x2ee230) returned 0 [0134.571] DispatchMessageW (lpMsg=0x2ee230) returned 0x0 [0134.579] BeginPaint (in: hWnd=0x50162, lpPaint=0x2ed968 | out: lpPaint=0x2ed968) returned 0x780106a6 [0134.581] GetWindowPlacement (in: hWnd=0x50162, lpwndpl=0x2ed488 | out: lpwndpl=0x2ed488) returned 1 [0134.581] GetClientRect (in: hWnd=0x50162, lpRect=0x2ed3a0 | out: lpRect=0x2ed3a0) returned 1 [0134.581] GetWindowTextLengthW (hWnd=0x50162) returned 5 [0134.581] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0134.581] GetSystemMetrics (nIndex=42) returned 0 [0134.581] GetWindowTextW (in: hWnd=0x50162, lpString=0x2ed110, nMaxCount=6 | out: lpString="Form1") returned 5 [0134.581] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xd, wParam=0x6, lParam=0x2ed110) returned 0x5 [0134.582] GetClientRect (in: hWnd=0x50162, lpRect=0x2ed188 | out: lpRect=0x2ed188) returned 1 [0134.583] GetCurrentObject (hdc=0x780106a6, type=0x1) returned 0x1b00017 [0134.583] GetCurrentObject (hdc=0x780106a6, type=0x2) returned 0x1900010 [0134.583] GetCurrentObject (hdc=0x780106a6, type=0x7) returned 0x1c0501a0 [0134.583] GetCurrentObject (hdc=0x780106a6, type=0x6) returned 0x18a002e [0134.584] SaveDC (hdc=0x780106a6) returned 1 [0134.584] GetNearestColor (hdc=0x780106a6, color=0xf0f0f0) returned 0xf0f0f0 [0134.584] CreateSolidBrush (color=0xf0f0f0) returned 0x17100283 [0134.584] FillRect (hDC=0x780106a6, lprc=0x2ece78, hbr=0x17100283) returned 1 [0134.584] DeleteObject (ho=0x17100283) returned 1 [0134.584] RestoreDC (hdc=0x780106a6, nSavedDC=-1) returned 1 [0134.588] GdipCreateHalftonePalette () returned 0x1b08024d [0134.589] SelectPalette (hdc=0x780106a6, hPal=0x1b08024d, bForceBkgd=1) returned 0x188000b [0134.589] GetWindowTextLengthW (hWnd=0x50162) returned 5 [0134.589] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0134.589] GetSystemMetrics (nIndex=42) returned 0 [0134.589] GetWindowTextW (in: hWnd=0x50162, lpString=0x2ed810, nMaxCount=6 | out: lpString="Form1") returned 5 [0134.589] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0xd, wParam=0x6, lParam=0x2ed810) returned 0x5 [0134.589] SelectPalette (hdc=0x780106a6, hPal=0x188000b, bForceBkgd=0) returned 0x1b08024d [0134.589] EndPaint (hWnd=0x50162, lpPaint=0x2ed908) returned 1 [0134.590] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0134.597] WriteFile (in: hFile=0x320, lpBuffer=0x29c0380*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ee248, lpOverlapped=0x0 | out: lpBuffer=0x29c0380*, lpNumberOfBytesWritten=0x2ee248*=0x1000, lpOverlapped=0x0) returned 1 [0134.598] ReadFile (in: hFile=0x34c, lpBuffer=0x127e2168, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x127e2168*, lpNumberOfBytesRead=0x2ee2b8*=0x0, lpOverlapped=0x0) returned 1 [0134.603] CloseHandle (hObject=0x34c) returned 1 [0134.603] WriteFile (in: hFile=0x320, lpBuffer=0x29c0380*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x2ee188, lpOverlapped=0x0 | out: lpBuffer=0x29c0380*, lpNumberOfBytesWritten=0x2ee188*=0xac0, lpOverlapped=0x0) returned 1 [0134.603] CloseHandle (hObject=0x320) returned 1 [0134.614] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", nBufferLength=0x105, lpBuffer=0x2eddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", lpFilePart=0x0) returned 0x43 [0134.615] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0134.618] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.enc", lpFilePart=0x0) returned 0x41 [0134.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0134.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0134.618] GetFileType (hFile=0x320) returned 0x1 [0134.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0134.618] GetFileType (hFile=0x320) returned 0x1 [0138.309] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpFilePart=0x0) returned 0x3d [0138.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0138.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0138.393] GetFileType (hFile=0x34c) returned 0x1 [0138.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0138.393] GetFileType (hFile=0x34c) returned 0x1 [0138.396] ReadFile (in: hFile=0x34c, lpBuffer=0x128e21a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x128e21a0*, lpNumberOfBytesRead=0x2ee2b8*=0x3adb, lpOverlapped=0x0) returned 1 [0138.547] GetCurrentActCtx (in: lphActCtx=0x2ee2e0 | out: lphActCtx=0x2ee2e0*=0x963ea8) returned 1 [0138.566] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0138.566] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0138.566] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0138.566] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0138.567] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0138.567] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0138.567] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0138.573] WriteFile (in: hFile=0x320, lpBuffer=0x28aa290*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ee248, lpOverlapped=0x0 | out: lpBuffer=0x28aa290*, lpNumberOfBytesWritten=0x2ee248*=0x1000, lpOverlapped=0x0) returned 1 [0138.574] WriteFile (in: hFile=0x320, lpBuffer=0x28ac9f0*, nNumberOfBytesToWrite=0x2af0, lpNumberOfBytesWritten=0x2ee2a8, lpOverlapped=0x0 | out: lpBuffer=0x28ac9f0*, lpNumberOfBytesWritten=0x2ee2a8*=0x2af0, lpOverlapped=0x0) returned 1 [0138.575] ReadFile (in: hFile=0x34c, lpBuffer=0x128e21a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x128e21a0*, lpNumberOfBytesRead=0x2ee2b8*=0x0, lpOverlapped=0x0) returned 1 [0138.575] CloseHandle (hObject=0x34c) returned 1 [0138.575] WriteFile (in: hFile=0x320, lpBuffer=0x28aa290*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2ee188, lpOverlapped=0x0 | out: lpBuffer=0x28aa290*, lpNumberOfBytesWritten=0x2ee188*=0x10, lpOverlapped=0x0) returned 1 [0138.576] CloseHandle (hObject=0x320) returned 1 [0138.590] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", nBufferLength=0x105, lpBuffer=0x2eddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", lpFilePart=0x0) returned 0x3d [0138.590] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0138.623] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.enc", lpFilePart=0x0) returned 0x41 [0138.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0138.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0138.623] GetFileType (hFile=0x320) returned 0x1 [0138.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0138.623] GetFileType (hFile=0x320) returned 0x1 [0143.070] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpFilePart=0x0) returned 0x3d [0143.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0143.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0143.268] GetFileType (hFile=0x34c) returned 0x1 [0143.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0143.268] GetFileType (hFile=0x34c) returned 0x1 [0143.325] ReadFile (in: hFile=0x34c, lpBuffer=0x129e21d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x129e21d8*, lpNumberOfBytesRead=0x2ee2b8*=0x425, lpOverlapped=0x0) returned 1 [0143.339] GetCurrentActCtx (in: lphActCtx=0x2ee2e0 | out: lphActCtx=0x2ee2e0*=0x963ea8) returned 1 [0143.339] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0143.339] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0143.339] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0143.339] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0143.339] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0143.339] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0143.339] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0143.341] ReadFile (in: hFile=0x34c, lpBuffer=0x129e21d8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x129e21d8*, lpNumberOfBytesRead=0x2ee2b8*=0x0, lpOverlapped=0x0) returned 1 [0143.341] CloseHandle (hObject=0x34c) returned 1 [0143.341] WriteFile (in: hFile=0x320, lpBuffer=0x2992608*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2ee188, lpOverlapped=0x0 | out: lpBuffer=0x2992608*, lpNumberOfBytesWritten=0x2ee188*=0x450, lpOverlapped=0x0) returned 1 [0143.342] CloseHandle (hObject=0x320) returned 1 [0143.348] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", nBufferLength=0x105, lpBuffer=0x2eddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", lpFilePart=0x0) returned 0x3d [0143.348] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0143.351] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.enc", lpFilePart=0x0) returned 0x41 [0143.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0143.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0143.352] GetFileType (hFile=0x320) returned 0x1 [0143.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0143.352] GetFileType (hFile=0x320) returned 0x1 [0146.056] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpFilePart=0x0) returned 0x3d [0146.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0146.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x158 [0146.057] GetFileType (hFile=0x158) returned 0x1 [0146.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0146.057] GetFileType (hFile=0x158) returned 0x1 [0146.957] ReadFile (in: hFile=0x158, lpBuffer=0x127e2168, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x127e2168*, lpNumberOfBytesRead=0x2ee2b8*=0x692, lpOverlapped=0x0) returned 1 [0147.633] GetCurrentActCtx (in: lphActCtx=0x2ee2e0 | out: lphActCtx=0x2ee2e0*=0x963ea8) returned 1 [0147.633] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0147.636] ReadFile (in: hFile=0x158, lpBuffer=0x127e2168, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x127e2168*, lpNumberOfBytesRead=0x2ee2b8*=0x0, lpOverlapped=0x0) returned 1 [0147.636] CloseHandle (hObject=0x158) returned 1 [0147.637] WriteFile (in: hFile=0x320, lpBuffer=0x2875fa0*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ee188, lpOverlapped=0x0 | out: lpBuffer=0x2875fa0*, lpNumberOfBytesWritten=0x2ee188*=0x6c0, lpOverlapped=0x0) returned 1 [0147.638] CloseHandle (hObject=0x320) returned 1 [0147.672] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", nBufferLength=0x105, lpBuffer=0x2eddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", lpFilePart=0x0) returned 0x3d [0147.672] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0147.675] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4f [0147.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0147.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0147.675] GetFileType (hFile=0x320) returned 0x1 [0147.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0147.676] GetFileType (hFile=0x320) returned 0x1 [0147.676] WriteFile (in: hFile=0x320, lpBuffer=0x287b5c0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x287b5c0*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0147.677] CloseHandle (hObject=0x320) returned 1 [0147.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0147.678] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT", lpFilePart=0x0) returned 0x36 [0147.678] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", lpFilePart=0x0) returned 0x37 [0147.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5edff70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5edff70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0147.679] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5edff70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5edff70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.680] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab28270, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9ab28270, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0x9e2cc4b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x1ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG.enc", cAlternateFileName="CGMIMP~1.ENC")) returned 1 [0147.680] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0147.680] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0147.680] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5edff70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa5edff70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5edff70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0147.680] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0147.681] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0147.681] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0147.681] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0147.681] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e2cc4b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0x9e2cc4b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa08961f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x3b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS.enc", cAlternateFileName="MSEPS~1.ENC")) returned 1 [0147.682] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0147.682] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0908610, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa0908610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa35f6550, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG.enc", cAlternateFileName="MSJPG~1.ENC")) returned 1 [0147.682] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa361c6b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa361c6b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5edff70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG.enc", cAlternateFileName="MSPNG~1.ENC")) returned 1 [0147.682] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0147.682] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0147.683] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0147.683] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0147.683] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0147.683] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0147.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0147.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0147.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0147.687] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Help", lpFilePart=0x0) returned 0x33 [0147.687] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpFilePart=0x0) returned 0x34 [0147.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0147.698] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0147.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0147.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0147.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0147.699] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0147.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0147.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0147.700] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4c [0147.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0147.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x320 [0147.700] GetFileType (hFile=0x320) returned 0x1 [0147.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0147.700] GetFileType (hFile=0x320) returned 0x1 [0147.701] WriteFile (in: hFile=0x320, lpBuffer=0x2883c40*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x2883c40*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0147.702] CloseHandle (hObject=0x320) returned 1 [0147.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0147.702] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Help", lpFilePart=0x0) returned 0x33 [0147.702] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", lpFilePart=0x0) returned 0x34 [0147.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5f060d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5f060d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0147.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5f060d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5f060d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5f060d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa5f060d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5f2c230, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0147.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0147.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0147.704] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0147.704] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0147.704] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0147.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0147.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0147.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0147.704] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpFilePart=0x0) returned 0x32 [0147.704] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpFilePart=0x0) returned 0x33 [0147.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0147.705] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.705] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0147.705] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0147.705] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0147.706] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0147.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0147.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0147.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0147.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0147.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0147.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0147.708] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0147.708] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0147.708] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0147.708] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0147.708] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0147.708] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0147.709] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0147.710] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0147.710] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0147.710] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0147.710] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0147.710] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0147.710] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0147.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0147.712] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0147.712] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0147.712] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0147.712] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0147.712] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0147.712] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0147.713] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0147.713] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0147.713] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0147.713] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0147.713] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0147.714] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0147.714] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0147.714] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0147.715] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0147.715] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0147.715] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0147.715] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0147.715] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0147.715] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0147.716] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0147.716] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0147.716] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0147.716] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0147.716] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0147.716] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0147.717] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0147.717] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0147.717] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0147.721] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0147.722] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0147.722] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0147.722] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0147.722] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0147.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0147.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0147.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0147.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0147.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0147.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0147.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0147.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0147.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0147.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0147.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0147.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0147.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0147.726] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0147.726] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0147.726] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0147.726] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0147.726] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0147.727] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0147.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0147.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0147.728] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.enc", lpFilePart=0x0) returned 0x49 [0147.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0147.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0147.729] GetFileType (hFile=0x320) returned 0x1 [0147.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0147.729] GetFileType (hFile=0x320) returned 0x1 [0150.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", lpFilePart=0x0) returned 0x45 [0150.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0150.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0150.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0150.686] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4b [0150.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0150.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x158 [0150.687] GetFileType (hFile=0x158) returned 0x1 [0150.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0150.687] GetFileType (hFile=0x158) returned 0x1 [0150.687] WriteFile (in: hFile=0x158, lpBuffer=0x29818d8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x29818d8*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0150.688] CloseHandle (hObject=0x158) returned 1 [0150.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0150.688] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink", lpFilePart=0x0) returned 0x32 [0150.688] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", lpFilePart=0x0) returned 0x33 [0150.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b244b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b244b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.689] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b244b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b244b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0150.689] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b244b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7b244b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b244b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0150.690] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5f52390, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa5f52390, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa5f52390, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi.enc", cAlternateFileName="FLICKA~1.ENC")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0150.691] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0150.692] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0150.692] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0150.692] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0150.692] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0150.692] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0150.692] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0150.692] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0150.693] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0150.693] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0150.693] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0150.693] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0150.693] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0150.693] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0150.693] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0150.694] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0150.694] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0150.694] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0150.694] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0150.694] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0150.694] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0150.695] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0150.695] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0150.695] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0150.695] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0150.695] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0150.695] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0150.696] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0150.696] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0150.696] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0150.696] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0150.696] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0150.696] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0150.697] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0150.697] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0150.697] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0150.697] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0150.697] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0150.698] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0150.698] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0150.698] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0150.698] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0150.698] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0150.698] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0150.699] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0150.700] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0150.701] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0150.701] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0150.701] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0150.701] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0150.701] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0150.701] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0150.701] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0150.702] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0150.702] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0150.702] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0150.702] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0150.702] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0150.702] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0150.702] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0150.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0150.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0150.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0150.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0150.703] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0150.704] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0150.704] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0150.704] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0150.704] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0150.704] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.704] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0150.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0150.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0150.705] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpFilePart=0x0) returned 0x38 [0150.705] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpFilePart=0x0) returned 0x39 [0150.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.707] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.707] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0150.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0150.708] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0150.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0150.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x158 [0150.708] GetFileType (hFile=0x158) returned 0x1 [0150.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0150.709] GetFileType (hFile=0x158) returned 0x1 [0150.709] WriteFile (in: hFile=0x158, lpBuffer=0x2992cc8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x2992cc8*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0150.710] CloseHandle (hObject=0x158) returned 1 [0150.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0150.710] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA", lpFilePart=0x0) returned 0x38 [0150.711] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", lpFilePart=0x0) returned 0x39 [0150.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b4a610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b4a610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b4a610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b4a610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b4a610, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7b4a610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b4a610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0150.711] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.712] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0150.712] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0150.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0150.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0150.713] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpFilePart=0x0) returned 0x38 [0150.713] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpFilePart=0x0) returned 0x39 [0150.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.713] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.714] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.714] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.714] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0150.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0150.714] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0150.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0150.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x158 [0150.715] GetFileType (hFile=0x158) returned 0x1 [0150.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0150.715] GetFileType (hFile=0x158) returned 0x1 [0150.715] WriteFile (in: hFile=0x158, lpBuffer=0x29998a8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x29998a8*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0150.716] CloseHandle (hObject=0x158) returned 1 [0150.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0150.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG", lpFilePart=0x0) returned 0x38 [0150.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", lpFilePart=0x0) returned 0x39 [0150.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.717] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.717] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b70770, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0150.718] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.718] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0150.718] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0150.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0150.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0150.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpFilePart=0x0) returned 0x38 [0150.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpFilePart=0x0) returned 0x39 [0150.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.719] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.720] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.720] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.720] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0150.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0150.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0150.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0150.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x158 [0150.721] GetFileType (hFile=0x158) returned 0x1 [0150.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0150.721] GetFileType (hFile=0x158) returned 0x1 [0150.721] WriteFile (in: hFile=0x158, lpBuffer=0x29a0488*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x29a0488*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0150.722] CloseHandle (hObject=0x158) returned 1 [0150.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0150.723] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ", lpFilePart=0x0) returned 0x38 [0150.723] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", lpFilePart=0x0) returned 0x39 [0150.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.723] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b70770, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0150.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.724] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0150.724] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0150.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0150.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0150.724] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpFilePart=0x0) returned 0x38 [0150.724] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpFilePart=0x0) returned 0x39 [0150.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.725] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.726] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.726] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.726] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0150.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0150.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0150.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0150.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x158 [0150.727] GetFileType (hFile=0x158) returned 0x1 [0150.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0150.727] GetFileType (hFile=0x158) returned 0x1 [0150.727] WriteFile (in: hFile=0x158, lpBuffer=0x29a7068*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x29a7068*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0150.728] CloseHandle (hObject=0x158) returned 1 [0150.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0150.729] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK", lpFilePart=0x0) returned 0x38 [0150.729] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", lpFilePart=0x0) returned 0x39 [0150.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.729] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b70770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.729] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b70770, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7b70770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b968d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0150.730] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.730] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0150.730] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0150.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0150.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0150.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpFilePart=0x0) returned 0x38 [0150.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpFilePart=0x0) returned 0x39 [0150.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.733] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.733] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.733] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.733] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0150.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0150.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0150.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0150.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x158 [0150.734] GetFileType (hFile=0x158) returned 0x1 [0150.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0150.734] GetFileType (hFile=0x158) returned 0x1 [0150.734] WriteFile (in: hFile=0x158, lpBuffer=0x29adc48*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x29adc48*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0150.736] CloseHandle (hObject=0x158) returned 1 [0150.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0150.736] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE", lpFilePart=0x0) returned 0x38 [0150.736] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", lpFilePart=0x0) returned 0x39 [0150.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b968d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b968d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.737] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b968d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b968d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.737] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b968d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7b968d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b968d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0150.737] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.737] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0150.737] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0150.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0150.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0150.738] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpFilePart=0x0) returned 0x38 [0150.738] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpFilePart=0x0) returned 0x39 [0150.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.738] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.739] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.739] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.739] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0150.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0150.739] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0150.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0150.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x158 [0150.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0150.740] WriteFile (in: hFile=0x158, lpBuffer=0x29b4828*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x29b4828*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0150.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0150.743] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR", lpFilePart=0x0) returned 0x38 [0150.743] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", lpFilePart=0x0) returned 0x39 [0150.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b968d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b968d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.743] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa7b968d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b968d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.743] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7b968d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7b968d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa7b968d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0150.743] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.744] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0150.744] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0150.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0150.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0150.744] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpFilePart=0x0) returned 0x38 [0150.744] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpFilePart=0x0) returned 0x39 [0150.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x17f920 [0150.747] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.747] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0150.747] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0150.747] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0150.747] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0150.748] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0150.748] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0150.748] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0150.748] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0150.748] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0150.748] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0150.748] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0150.749] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0150.749] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0150.749] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0150.749] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0150.749] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0150.749] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0150.750] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0150.750] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0150.750] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0150.750] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0150.750] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0150.750] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0150.750] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0150.751] FindNextFileW (in: hFindFile=0x17f920, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.751] FindClose (in: hFindFile=0x17f920 | out: hFindFile=0x17f920) returned 1 [0150.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0150.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0150.753] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.enc", lpFilePart=0x0) returned 0x4e [0150.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0150.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x158 [0150.755] GetFileType (hFile=0x158) returned 0x1 [0150.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0150.756] GetFileType (hFile=0x158) returned 0x1 [0152.052] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", lpFilePart=0x0) returned 0x4a [0152.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0152.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0152.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0152.057] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.enc", lpFilePart=0x0) returned 0x4d [0152.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0152.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f8 [0152.057] GetFileType (hFile=0x2f8) returned 0x1 [0152.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0152.057] GetFileType (hFile=0x2f8) returned 0x1 [0157.621] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", lpFilePart=0x0) returned 0x49 [0157.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0157.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0157.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0157.633] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.enc", lpFilePart=0x0) returned 0x4b [0157.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0157.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x158 [0157.634] GetFileType (hFile=0x158) returned 0x1 [0157.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0157.635] GetFileType (hFile=0x158) returned 0x1 [0161.484] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", lpFilePart=0x0) returned 0x47 [0161.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0161.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0161.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0161.490] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.enc", lpFilePart=0x0) returned 0x4c [0161.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0161.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0161.492] GetFileType (hFile=0x320) returned 0x1 [0161.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0161.492] GetFileType (hFile=0x320) returned 0x1 [0163.456] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", lpFilePart=0x0) returned 0x48 [0163.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0163.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0163.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0163.490] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.enc", lpFilePart=0x0) returned 0x48 [0163.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0163.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0163.491] GetFileType (hFile=0x34c) returned 0x1 [0163.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0163.491] GetFileType (hFile=0x34c) returned 0x1 [0164.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", lpFilePart=0x0) returned 0x44 [0164.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0164.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0164.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0164.932] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.enc", lpFilePart=0x0) returned 0x47 [0164.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0164.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x158 [0164.947] GetFileType (hFile=0x158) returned 0x1 [0164.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0164.947] GetFileType (hFile=0x158) returned 0x1 [0166.658] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", lpFilePart=0x0) returned 0x43 [0166.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0166.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0166.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0166.667] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.enc", lpFilePart=0x0) returned 0x45 [0166.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0166.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0166.669] GetFileType (hFile=0x320) returned 0x1 [0166.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0166.669] GetFileType (hFile=0x320) returned 0x1 [0168.445] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", lpFilePart=0x0) returned 0x41 [0168.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0168.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0168.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0168.450] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.enc", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.enc", lpFilePart=0x0) returned 0x46 [0168.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0168.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0168.452] GetFileType (hFile=0x35c) returned 0x1 [0168.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0a0) returned 1 [0168.452] GetFileType (hFile=0x35c) returned 0x1 [0169.644] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", nBufferLength=0x105, lpBuffer=0x2edc50, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", lpFilePart=0x0) returned 0x42 [0169.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee130) returned 1 [0169.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0169.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaa70) returned 1 [0169.648] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.649] GetFileType (hFile=0x358) returned 0x1 [0169.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.649] GetFileType (hFile=0x358) returned 0x1 [0169.650] WriteFile (in: hFile=0x358, lpBuffer=0x28f66f0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x28f66f0*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0169.651] CloseHandle (hObject=0x358) returned 1 [0169.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.652] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US", lpFilePart=0x0) returned 0x38 [0169.652] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", lpFilePart=0x0) returned 0x39 [0169.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e1dad0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e1dad0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.653] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e1dad0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e1dad0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.653] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0169.653] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7bbca30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa7bbca30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xaa26afb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x20, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi.enc", cAlternateFileName="BOXED-~1.ENC")) returned 1 [0169.653] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0169.654] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa883bdb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xa883bdb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xa883bdb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi.enc", cAlternateFileName="BOXED-~2.ENC")) returned 1 [0169.654] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0169.654] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabce6470, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xabce6470, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb00e38d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x20, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi.enc", cAlternateFileName="BOXED-~3.ENC")) returned 1 [0169.654] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0169.654] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae1333f0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xae1333f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb00bd770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x20, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi.enc", cAlternateFileName="BOXED-~4.ENC")) returned 1 [0169.654] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0169.655] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf43e3f0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xaf43e3f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xaf43e3f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi.enc", cAlternateFileName="CORREC~1.ENC")) returned 1 [0169.655] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e1dad0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2e1dad0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e43c30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.655] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0169.655] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0155cf0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb0155cf0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb0155cf0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi.enc", cAlternateFileName="DELETE~1.ENC")) returned 1 [0169.655] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0169.656] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0169.656] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0169.656] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0169.656] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0169.656] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0169.656] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0169.657] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11d9590, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb11d9590, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb11d9590, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi.enc", cAlternateFileName="JOINAV~1.ENC")) returned 1 [0169.657] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0169.657] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0169.657] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0169.657] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0169.657] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0169.658] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0169.658] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb22f53b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb22f53b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb22f53b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi.enc", cAlternateFileName="SPLITA~1.ENC")) returned 1 [0169.658] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0169.658] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0169.658] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0169.659] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.659] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0169.659] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0169.659] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpFilePart=0x0) returned 0x38 [0169.660] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", lpFilePart=0x0) returned 0x39 [0169.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.661] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.661] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.661] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.662] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.662] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.663] GetFileType (hFile=0x358) returned 0x1 [0169.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.663] GetFileType (hFile=0x358) returned 0x1 [0169.663] WriteFile (in: hFile=0x358, lpBuffer=0x2900b18*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x2900b18*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0169.664] CloseHandle (hObject=0x358) returned 1 [0169.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES", lpFilePart=0x0) returned 0x38 [0169.665] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", lpFilePart=0x0) returned 0x39 [0169.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e43c30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e43c30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.665] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e43c30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e43c30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.665] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e43c30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2e43c30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e43c30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.666] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.666] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.666] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.667] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpFilePart=0x0) returned 0x38 [0169.667] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", lpFilePart=0x0) returned 0x39 [0169.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.668] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.669] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.669] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.669] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.669] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.670] GetFileType (hFile=0x358) returned 0x1 [0169.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.670] GetFileType (hFile=0x358) returned 0x1 [0169.670] WriteFile (in: hFile=0x358, lpBuffer=0x29076f8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x29076f8*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0169.671] CloseHandle (hObject=0x358) returned 1 [0169.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.672] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE", lpFilePart=0x0) returned 0x38 [0169.673] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", lpFilePart=0x0) returned 0x39 [0169.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.673] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e69d90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.674] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.674] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpFilePart=0x0) returned 0x38 [0169.674] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", lpFilePart=0x0) returned 0x39 [0169.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.675] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.675] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.675] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.675] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.675] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.677] GetFileType (hFile=0x358) returned 0x1 [0169.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.677] GetFileType (hFile=0x358) returned 0x1 [0169.677] WriteFile (in: hFile=0x358, lpBuffer=0x290e2d8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x290e2d8*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0169.678] CloseHandle (hObject=0x358) returned 1 [0169.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.679] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI", lpFilePart=0x0) returned 0x38 [0169.679] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", lpFilePart=0x0) returned 0x39 [0169.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.679] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.679] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e69d90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.679] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.679] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.680] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpFilePart=0x0) returned 0x38 [0169.680] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", lpFilePart=0x0) returned 0x39 [0169.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.680] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.681] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.681] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.681] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.681] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.682] GetFileType (hFile=0x358) returned 0x1 [0169.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.682] GetFileType (hFile=0x358) returned 0x1 [0169.682] WriteFile (in: hFile=0x358, lpBuffer=0x2914eb8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x2914eb8*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0169.683] CloseHandle (hObject=0x358) returned 1 [0169.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.683] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR", lpFilePart=0x0) returned 0x38 [0169.683] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", lpFilePart=0x0) returned 0x39 [0169.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.684] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e69d90, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.684] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e69d90, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2e69d90, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2e8fef0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.685] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.685] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.685] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpFilePart=0x0) returned 0x40 [0169.685] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpFilePart=0x0) returned 0x41 [0169.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.703] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.704] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0169.704] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0169.704] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0169.704] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0169.704] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0169.705] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0169.705] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0169.705] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0169.705] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0169.705] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0169.705] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0169.706] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0169.706] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0169.706] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0169.706] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0169.706] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0169.707] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0169.707] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0169.707] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.707] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.708] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x59 [0169.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.710] GetFileType (hFile=0x358) returned 0x1 [0169.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.710] GetFileType (hFile=0x358) returned 0x1 [0169.711] WriteFile (in: hFile=0x358, lpBuffer=0x291dee0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x291dee0*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0169.712] CloseHandle (hObject=0x358) returned 1 [0169.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions", lpFilePart=0x0) returned 0x40 [0169.712] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", lpFilePart=0x0) returned 0x41 [0169.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2eb6050, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2eb6050, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.713] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2eb6050, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2eb6050, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.713] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0169.713] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0169.714] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2eb6050, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2eb6050, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2eb6050, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.714] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0169.714] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0169.714] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0169.714] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0169.715] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0169.715] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0169.715] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0169.715] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0169.715] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0169.716] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0169.716] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0169.716] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0169.716] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0169.716] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0169.717] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0169.717] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0169.717] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0169.717] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpFilePart=0x0) returned 0x47 [0169.718] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", lpFilePart=0x0) returned 0x48 [0169.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.719] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.720] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0169.720] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.720] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x60 [0169.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.722] GetFileType (hFile=0x358) returned 0x1 [0169.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.722] GetFileType (hFile=0x358) returned 0x1 [0169.722] WriteFile (in: hFile=0x358, lpBuffer=0x2926ef0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee118, lpOverlapped=0x0 | out: lpBuffer=0x2926ef0*, lpNumberOfBytesWritten=0x2ee118*=0x77c, lpOverlapped=0x0) returned 1 [0169.723] CloseHandle (hObject=0x358) returned 1 [0169.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.724] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad", lpFilePart=0x0) returned 0x47 [0169.724] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", lpFilePart=0x0) returned 0x48 [0169.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2edc1b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2edc1b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.724] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2edc1b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2edc1b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.725] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0169.725] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2edc1b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2edc1b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2edc1b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.725] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2edc1b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2edc1b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2edc1b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0169.725] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpFilePart=0x0) returned 0x47 [0169.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpFilePart=0x0) returned 0x48 [0169.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.726] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.727] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0169.727] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0169.727] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0169.727] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.727] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.728] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x60 [0169.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.728] GetFileType (hFile=0x358) returned 0x1 [0169.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.728] GetFileType (hFile=0x358) returned 0x1 [0169.729] WriteFile (in: hFile=0x358, lpBuffer=0x292e3f0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee118, lpOverlapped=0x0 | out: lpBuffer=0x292e3f0*, lpNumberOfBytesWritten=0x2ee118*=0x77c, lpOverlapped=0x0) returned 1 [0169.730] CloseHandle (hObject=0x358) returned 1 [0169.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.731] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad", lpFilePart=0x0) returned 0x47 [0169.731] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", lpFilePart=0x0) returned 0x48 [0169.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2edc1b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2edc1b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.731] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2edc1b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2edc1b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.731] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2edc1b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2edc1b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2f02310, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.732] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0169.732] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0169.732] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0169.732] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0169.732] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpFilePart=0x0) returned 0x45 [0169.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpFilePart=0x0) returned 0x46 [0169.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.781] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0169.782] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0169.783] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0169.784] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.784] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x5e [0169.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.787] WriteFile (in: hFile=0x358, lpBuffer=0x2937638*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee118, lpOverlapped=0x0 | out: lpBuffer=0x2937638*, lpNumberOfBytesWritten=0x2ee118*=0x77c, lpOverlapped=0x0) returned 1 [0169.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main", lpFilePart=0x0) returned 0x45 [0169.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", lpFilePart=0x0) returned 0x46 [0169.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2f74730, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2f74730, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.790] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2f74730, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2f74730, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.790] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0169.790] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0169.791] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0169.791] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0169.791] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0169.791] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0169.791] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0169.792] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0169.792] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2f74730, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2f74730, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2f74730, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.792] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0169.792] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0169.792] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0169.817] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0169.818] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0169.818] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0169.818] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.818] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpFilePart=0x0) returned 0x48 [0169.818] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpFilePart=0x0) returned 0x49 [0169.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.819] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.819] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0169.819] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.819] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.820] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x61 [0169.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.821] WriteFile (in: hFile=0x358, lpBuffer=0x293fc28*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee118, lpOverlapped=0x0 | out: lpBuffer=0x293fc28*, lpNumberOfBytesWritten=0x2ee118*=0x77c, lpOverlapped=0x0) returned 1 [0169.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.823] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers", lpFilePart=0x0) returned 0x48 [0169.823] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", lpFilePart=0x0) returned 0x49 [0169.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2fc09f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fc09f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.823] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2fc09f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fc09f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.823] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2fc09f0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2fc09f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fe6b50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.823] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0169.824] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0169.824] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.824] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpFilePart=0x0) returned 0x48 [0169.824] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpFilePart=0x0) returned 0x49 [0169.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.826] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.826] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0169.826] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.826] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.827] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x61 [0169.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.828] WriteFile (in: hFile=0x358, lpBuffer=0x2946c28*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee118, lpOverlapped=0x0 | out: lpBuffer=0x2946c28*, lpNumberOfBytesWritten=0x2ee118*=0x77c, lpOverlapped=0x0) returned 1 [0169.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu", lpFilePart=0x0) returned 0x48 [0169.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", lpFilePart=0x0) returned 0x49 [0169.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2fe6b50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fe6b50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.829] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2fe6b50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fe6b50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.830] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2fe6b50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2fe6b50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fe6b50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.830] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0169.830] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0169.830] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.831] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpFilePart=0x0) returned 0x4a [0169.831] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpFilePart=0x0) returned 0x4b [0169.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.831] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.832] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0169.832] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.832] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.832] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x63 [0169.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.833] WriteFile (in: hFile=0x358, lpBuffer=0x294dca8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee118, lpOverlapped=0x0 | out: lpBuffer=0x294dca8*, lpNumberOfBytesWritten=0x2ee118*=0x77c, lpOverlapped=0x0) returned 1 [0169.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.835] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad", lpFilePart=0x0) returned 0x4a [0169.835] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", lpFilePart=0x0) returned 0x4b [0169.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2fe6b50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fe6b50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.835] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb2fe6b50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fe6b50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.835] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2fe6b50, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb2fe6b50, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb2fe6b50, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.836] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0169.836] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0169.836] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.836] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpFilePart=0x0) returned 0x48 [0169.837] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpFilePart=0x0) returned 0x49 [0169.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.837] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.838] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0169.838] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.838] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.839] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x61 [0169.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.841] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred", lpFilePart=0x0) returned 0x48 [0169.841] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", lpFilePart=0x0) returned 0x49 [0169.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.842] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.842] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb300ccb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.842] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0169.842] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0169.843] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.843] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpFilePart=0x0) returned 0x48 [0169.843] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpFilePart=0x0) returned 0x49 [0169.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.843] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.844] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0169.844] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0169.844] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0169.844] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.844] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.844] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x61 [0169.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.846] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols", lpFilePart=0x0) returned 0x48 [0169.846] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", lpFilePart=0x0) returned 0x49 [0169.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.847] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.847] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb300ccb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.847] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0169.847] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0169.847] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0169.848] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0169.848] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0169.848] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpFilePart=0x0) returned 0x44 [0169.848] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpFilePart=0x0) returned 0x45 [0169.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.849] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.850] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0169.850] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.850] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0169.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0169.850] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x5d [0169.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0169.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0169.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0169.852] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web", lpFilePart=0x0) returned 0x44 [0169.852] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", lpFilePart=0x0) returned 0x45 [0169.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.852] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.852] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb300ccb0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb300ccb0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb300ccb0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.852] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0169.853] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0169.853] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0169.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0169.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.853] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpFilePart=0x0) returned 0x38 [0169.853] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpFilePart=0x0) returned 0x39 [0169.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.854] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.854] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.855] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.855] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.855] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.859] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL", lpFilePart=0x0) returned 0x38 [0169.860] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", lpFilePart=0x0) returned 0x39 [0169.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.860] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3032e10, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.860] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.861] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.861] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpFilePart=0x0) returned 0x38 [0169.861] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpFilePart=0x0) returned 0x39 [0169.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.861] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.862] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.862] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.864] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR", lpFilePart=0x0) returned 0x38 [0169.864] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", lpFilePart=0x0) returned 0x39 [0169.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.864] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3032e10, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.864] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.865] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.865] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.865] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpFilePart=0x0) returned 0x38 [0169.865] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpFilePart=0x0) returned 0x39 [0169.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.866] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.866] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.866] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.866] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.866] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.869] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU", lpFilePart=0x0) returned 0x38 [0169.869] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", lpFilePart=0x0) returned 0x39 [0169.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.869] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.870] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3032e10, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3032e10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3032e10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.870] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.870] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.870] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.870] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpFilePart=0x0) returned 0x43 [0169.870] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", lpFilePart=0x0) returned 0x44 [0169.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.871] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.872] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0169.872] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.872] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x5c [0169.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.873] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization", lpFilePart=0x0) returned 0x43 [0169.873] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", lpFilePart=0x0) returned 0x44 [0169.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.874] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.874] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3058f70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.874] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3058f70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0169.874] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.874] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpFilePart=0x0) returned 0x38 [0169.874] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpFilePart=0x0) returned 0x39 [0169.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.875] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.875] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.875] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.875] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.880] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT", lpFilePart=0x0) returned 0x38 [0169.880] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", lpFilePart=0x0) returned 0x39 [0169.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.880] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3058f70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.880] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.881] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.881] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpFilePart=0x0) returned 0x38 [0169.881] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpFilePart=0x0) returned 0x39 [0169.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.881] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.881] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.882] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.882] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.882] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.884] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP", lpFilePart=0x0) returned 0x38 [0169.884] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", lpFilePart=0x0) returned 0x39 [0169.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.885] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3058f70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3058f70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3058f70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.885] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.885] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.886] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpFilePart=0x0) returned 0x38 [0169.886] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpFilePart=0x0) returned 0x39 [0169.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.886] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.886] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.887] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.887] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.889] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR", lpFilePart=0x0) returned 0x38 [0169.889] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", lpFilePart=0x0) returned 0x39 [0169.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb307f0d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb307f0d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.889] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb307f0d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb307f0d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb307f0d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb307f0d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb307f0d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.889] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0169.890] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.890] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpFilePart=0x0) returned 0x38 [0169.890] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpFilePart=0x0) returned 0x39 [0169.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.891] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.891] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0169.892] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0169.892] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.892] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0169.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.894] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT", lpFilePart=0x0) returned 0x38 [0169.894] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", lpFilePart=0x0) returned 0x39 [0169.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb307f0d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb307f0d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.895] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.895] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpFilePart=0x0) returned 0x38 [0169.895] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpFilePart=0x0) returned 0x39 [0169.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.896] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.896] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.899] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV", lpFilePart=0x0) returned 0x38 [0169.899] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", lpFilePart=0x0) returned 0x39 [0169.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb307f0d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb307f0d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.899] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.900] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpFilePart=0x0) returned 0x38 [0169.900] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpFilePart=0x0) returned 0x39 [0169.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.900] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.901] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.903] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO", lpFilePart=0x0) returned 0x38 [0169.903] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", lpFilePart=0x0) returned 0x39 [0169.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30a5230, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30a5230, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.904] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.904] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpFilePart=0x0) returned 0x38 [0169.904] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpFilePart=0x0) returned 0x39 [0169.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.905] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.905] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.907] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL", lpFilePart=0x0) returned 0x38 [0169.907] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", lpFilePart=0x0) returned 0x39 [0169.907] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30a5230, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30a5230, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.907] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.907] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpFilePart=0x0) returned 0x38 [0169.908] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpFilePart=0x0) returned 0x39 [0169.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.909] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.909] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.911] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL", lpFilePart=0x0) returned 0x38 [0169.911] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", lpFilePart=0x0) returned 0x39 [0169.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30a5230, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30a5230, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.911] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.912] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpFilePart=0x0) returned 0x38 [0169.912] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpFilePart=0x0) returned 0x39 [0169.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.912] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.913] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR", lpFilePart=0x0) returned 0x38 [0169.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", lpFilePart=0x0) returned 0x39 [0169.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30a5230, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30a5230, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.915] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.915] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpFilePart=0x0) returned 0x38 [0169.915] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpFilePart=0x0) returned 0x39 [0169.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.916] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.916] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT", lpFilePart=0x0) returned 0x38 [0169.919] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", lpFilePart=0x0) returned 0x39 [0169.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30cb390, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30cb390, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.919] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpFilePart=0x0) returned 0x38 [0169.920] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpFilePart=0x0) returned 0x39 [0169.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.920] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.921] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO", lpFilePart=0x0) returned 0x38 [0169.922] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", lpFilePart=0x0) returned 0x39 [0169.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30cb390, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30cb390, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.922] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.923] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpFilePart=0x0) returned 0x38 [0169.923] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpFilePart=0x0) returned 0x39 [0169.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.924] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.924] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0169.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0169.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU", lpFilePart=0x0) returned 0x38 [0169.925] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", lpFilePart=0x0) returned 0x39 [0169.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30cb390, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30cb390, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.926] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0169.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0169.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0169.926] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpFilePart=0x0) returned 0x38 [0169.926] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpFilePart=0x0) returned 0x39 [0169.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.926] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0169.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0169.927] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0169.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK", lpFilePart=0x0) returned 0x38 [0169.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", lpFilePart=0x0) returned 0x39 [0169.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30cb390, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30cb390, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.928] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpFilePart=0x0) returned 0x38 [0169.928] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpFilePart=0x0) returned 0x39 [0169.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.929] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.929] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.931] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI", lpFilePart=0x0) returned 0x38 [0169.931] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", lpFilePart=0x0) returned 0x39 [0169.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30cb390, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30cb390, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.932] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.932] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpFilePart=0x0) returned 0x3d [0169.932] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpFilePart=0x0) returned 0x3e [0169.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.932] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.933] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x56 [0169.934] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS", lpFilePart=0x0) returned 0x3d [0169.934] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", lpFilePart=0x0) returned 0x3e [0169.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30f14f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30f14f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.934] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.934] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpFilePart=0x0) returned 0x38 [0169.934] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpFilePart=0x0) returned 0x39 [0169.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.936] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.936] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.937] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE", lpFilePart=0x0) returned 0x38 [0169.937] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", lpFilePart=0x0) returned 0x39 [0169.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30f14f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30f14f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.938] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.938] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpFilePart=0x0) returned 0x38 [0169.938] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpFilePart=0x0) returned 0x39 [0169.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.938] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.938] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.940] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH", lpFilePart=0x0) returned 0x38 [0169.940] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", lpFilePart=0x0) returned 0x39 [0169.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30f14f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30f14f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.940] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.940] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpFilePart=0x0) returned 0x38 [0169.940] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpFilePart=0x0) returned 0x39 [0169.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.941] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.941] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.942] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR", lpFilePart=0x0) returned 0x38 [0169.942] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", lpFilePart=0x0) returned 0x39 [0169.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30f14f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30f14f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.943] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.943] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpFilePart=0x0) returned 0x38 [0169.943] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpFilePart=0x0) returned 0x39 [0169.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.943] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.943] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0169.945] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA", lpFilePart=0x0) returned 0x38 [0169.945] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", lpFilePart=0x0) returned 0x39 [0169.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb30f14f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb30f14f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.945] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.945] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpFilePart=0x0) returned 0x38 [0169.945] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpFilePart=0x0) returned 0x39 [0169.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0169.946] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0169.946] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0170.013] WriteFile (in: hFile=0x358, lpBuffer=0x2807220*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x2807220*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0170.014] CloseHandle (hObject=0x358) returned 1 [0170.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0170.015] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN", lpFilePart=0x0) returned 0x38 [0170.015] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", lpFilePart=0x0) returned 0x39 [0170.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3189a70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3189a70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.015] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb3189a70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3189a70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.015] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3189a70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3189a70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31afbd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.016] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0170.016] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0170.016] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0170.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0170.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0170.016] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpFilePart=0x0) returned 0x38 [0170.016] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpFilePart=0x0) returned 0x39 [0170.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.017] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.017] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0170.017] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.017] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0170.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0170.018] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0170.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0170.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.018] GetFileType (hFile=0x358) returned 0x1 [0170.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0170.018] GetFileType (hFile=0x358) returned 0x1 [0170.018] WriteFile (in: hFile=0x358, lpBuffer=0x280de00*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x280de00*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0170.019] CloseHandle (hObject=0x358) returned 1 [0170.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0170.020] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW", lpFilePart=0x0) returned 0x38 [0170.020] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", lpFilePart=0x0) returned 0x39 [0170.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb31afbd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31afbd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.020] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb31afbd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31afbd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.020] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31afbd0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb31afbd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31afbd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.021] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0170.021] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0170.021] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0170.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0170.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0170.021] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", lpFilePart=0x0) returned 0x3e [0170.021] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", lpFilePart=0x0) returned 0x3f [0170.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.023] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.023] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0170.023] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.023] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0170.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.023] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0170.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0170.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.024] GetFileType (hFile=0x358) returned 0x1 [0170.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0170.024] GetFileType (hFile=0x358) returned 0x1 [0170.024] WriteFile (in: hFile=0x358, lpBuffer=0x2814a98*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x2814a98*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0170.025] CloseHandle (hObject=0x358) returned 1 [0170.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0170.026] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr", lpFilePart=0x0) returned 0x3e [0170.026] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", lpFilePart=0x0) returned 0x3f [0170.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb31afbd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31afbd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.026] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb31afbd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31afbd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.026] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31afbd0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb31afbd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31d5d30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.026] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0170.027] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0170.027] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0170.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0170.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0170.027] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpFilePart=0x0) returned 0x35 [0170.027] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", lpFilePart=0x0) returned 0x36 [0170.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.028] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.028] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0170.028] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0170.028] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.028] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0170.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.028] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4e [0170.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0170.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.029] GetFileType (hFile=0x358) returned 0x1 [0170.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0170.029] GetFileType (hFile=0x358) returned 0x1 [0170.029] WriteFile (in: hFile=0x358, lpBuffer=0x281b810*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x281b810*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0170.030] CloseHandle (hObject=0x358) returned 1 [0170.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0170.031] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo", lpFilePart=0x0) returned 0x35 [0170.031] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", lpFilePart=0x0) returned 0x36 [0170.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb31d5d30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31d5d30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.031] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb31d5d30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31d5d30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.031] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31d5d30, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb31d5d30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb31d5d30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.031] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0170.031] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0170.032] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0170.032] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0170.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0170.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0170.032] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpFilePart=0x0) returned 0x3b [0170.032] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", lpFilePart=0x0) returned 0x3c [0170.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.032] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.033] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0170.033] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.033] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0170.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0170.033] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x54 [0170.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0170.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.144] GetFileType (hFile=0x358) returned 0x1 [0170.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0170.144] GetFileType (hFile=0x358) returned 0x1 [0170.145] WriteFile (in: hFile=0x358, lpBuffer=0x28225e8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x28225e8*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0170.146] CloseHandle (hObject=0x358) returned 1 [0170.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0170.147] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US", lpFilePart=0x0) returned 0x3b [0170.147] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", lpFilePart=0x0) returned 0x3c [0170.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb32e06d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb32e06d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.147] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb32e06d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb32e06d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.147] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32e06d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb32e06d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb32e06d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.148] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0170.148] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0170.148] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0170.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0170.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0170.148] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", lpFilePart=0x0) returned 0x37 [0170.148] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpFilePart=0x0) returned 0x38 [0170.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.149] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.149] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0170.150] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0170.150] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0170.150] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0170.150] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0170.150] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0170.151] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0170.151] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0170.151] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0170.151] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0170.152] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0170.152] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0170.152] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0170.152] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0170.152] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0170.152] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0170.153] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0170.153] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0170.153] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0170.153] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0170.153] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0170.154] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0170.154] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0170.154] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0170.154] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0170.154] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0170.154] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0170.155] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0170.156] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0170.156] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0170.156] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0170.156] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0170.156] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0170.157] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0170.158] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0170.158] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0170.158] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0170.158] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0170.158] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0170.159] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.160] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0170.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.161] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x50 [0170.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0170.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.362] GetFileType (hFile=0x358) returned 0x1 [0170.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0170.362] GetFileType (hFile=0x358) returned 0x1 [0170.362] WriteFile (in: hFile=0x358, lpBuffer=0x2830d00*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x2830d00*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0170.363] CloseHandle (hObject=0x358) returned 1 [0170.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0170.364] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14", lpFilePart=0x0) returned 0x37 [0170.364] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", lpFilePart=0x0) returned 0x38 [0170.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb34f5a10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb34f5a10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.364] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb34f5a10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb34f5a10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.364] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0170.365] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0170.366] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0170.366] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0170.366] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0170.366] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0170.366] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0170.367] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0170.368] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3306830, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3306830, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb34f5a10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0170.369] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0170.370] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0170.371] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0170.372] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0170.372] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0170.372] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0170.372] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0170.372] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0170.373] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0170.373] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0170.373] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0170.373] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0170.373] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0170.374] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0170.374] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0170.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0170.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0170.375] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", lpFilePart=0x0) returned 0x3c [0170.375] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpFilePart=0x0) returned 0x3d [0170.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.376] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.378] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0170.378] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0170.378] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0170.378] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0170.378] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0170.378] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0170.379] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0170.380] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.380] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0170.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0170.381] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x55 [0170.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0170.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0170.384] WriteFile (in: hFile=0x358, lpBuffer=0x283eef0*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x283eef0*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0170.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0170.386] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033", lpFilePart=0x0) returned 0x3c [0170.386] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", lpFilePart=0x0) returned 0x3d [0170.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb351bb70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb351bb70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.386] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb351bb70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb351bb70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0170.387] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb351bb70, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb351bb70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3541cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0170.388] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0170.389] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0170.389] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0170.389] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0170.389] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0170.390] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0170.390] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0170.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0170.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0170.390] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", lpFilePart=0x0) returned 0x40 [0170.390] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", lpFilePart=0x0) returned 0x41 [0170.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.392] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.392] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0170.392] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.393] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0170.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0170.393] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x59 [0170.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0170.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0170.394] WriteFile (in: hFile=0x358, lpBuffer=0x2847218*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x2847218*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0170.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0170.395] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures", lpFilePart=0x0) returned 0x40 [0170.395] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", lpFilePart=0x0) returned 0x41 [0170.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb3541cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3541cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.396] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb3541cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3541cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.396] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3541cd0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3541cd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3541cd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.396] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0170.396] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0170.397] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0170.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0170.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0170.397] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", lpFilePart=0x0) returned 0x4f [0170.397] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpFilePart=0x0) returned 0x50 [0170.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.400] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0170.401] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0170.402] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0170.403] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0170.403] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0170.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0170.404] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x68 [0170.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0170.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0170.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0170.466] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller", lpFilePart=0x0) returned 0x4f [0170.466] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", lpFilePart=0x0) returned 0x50 [0170.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb36003b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb36003b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb36003b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb36003b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0170.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb36003b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb36003b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb36003b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0170.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0170.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0170.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.469] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0170.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0170.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.469] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpFilePart=0x0) returned 0x5c [0170.469] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpFilePart=0x0) returned 0x5d [0170.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.606] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.606] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0170.606] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0170.607] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.608] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x75 [0170.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.612] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us", lpFilePart=0x0) returned 0x5c [0170.612] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", lpFilePart=0x0) returned 0x5d [0170.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb3757010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3757010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.613] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.613] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpFilePart=0x0) returned 0x5b [0170.613] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpFilePart=0x0) returned 0x5c [0170.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.615] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.615] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x74 [0170.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.617] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us", lpFilePart=0x0) returned 0x5b [0170.617] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", lpFilePart=0x0) returned 0x5c [0170.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb3757010, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3757010, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.618] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.618] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpFilePart=0x0) returned 0x5c [0170.618] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpFilePart=0x0) returned 0x5d [0170.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.623] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.624] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x75 [0170.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.628] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us", lpFilePart=0x0) returned 0x5c [0170.628] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", lpFilePart=0x0) returned 0x5d [0170.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb377d170, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb377d170, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.628] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.628] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpFilePart=0x0) returned 0x5e [0170.628] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpFilePart=0x0) returned 0x5f [0170.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.630] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.630] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x77 [0170.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.645] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us", lpFilePart=0x0) returned 0x5e [0170.645] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", lpFilePart=0x0) returned 0x5f [0170.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb37a32d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb37a32d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.645] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.646] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpFilePart=0x0) returned 0x5c [0170.646] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpFilePart=0x0) returned 0x5d [0170.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.709] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.710] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x75 [0170.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.714] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us", lpFilePart=0x0) returned 0x5c [0170.714] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", lpFilePart=0x0) returned 0x5d [0170.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb383b850, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb383b850, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.714] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", lpFilePart=0x0) returned 0x5e [0170.715] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpFilePart=0x0) returned 0x5f [0170.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.716] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.717] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x77 [0170.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.720] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us", lpFilePart=0x0) returned 0x5e [0170.721] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", lpFilePart=0x0) returned 0x5f [0170.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb38619b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38619b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.721] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.721] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", lpFilePart=0x0) returned 0x5b [0170.721] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpFilePart=0x0) returned 0x5c [0170.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.723] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.723] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x74 [0170.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.725] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW", lpFilePart=0x0) returned 0x5b [0170.725] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", lpFilePart=0x0) returned 0x5c [0170.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb38619b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38619b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.726] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpFilePart=0x0) returned 0x5d [0170.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpFilePart=0x0) returned 0x5e [0170.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.728] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.728] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x76 [0170.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us", lpFilePart=0x0) returned 0x5d [0170.733] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", lpFilePart=0x0) returned 0x5e [0170.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb3887b10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3887b10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.734] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.734] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpFilePart=0x0) returned 0x5d [0170.734] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpFilePart=0x0) returned 0x5e [0170.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.736] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.736] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x76 [0170.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.740] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us", lpFilePart=0x0) returned 0x5d [0170.741] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", lpFilePart=0x0) returned 0x5e [0170.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb3887b10, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3887b10, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.741] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.741] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpFilePart=0x0) returned 0x60 [0170.741] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpFilePart=0x0) returned 0x61 [0170.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.743] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.749] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x79 [0170.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.754] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us", lpFilePart=0x0) returned 0x60 [0170.754] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", lpFilePart=0x0) returned 0x61 [0170.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb38adc70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38adc70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.754] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.755] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpFilePart=0x0) returned 0x57 [0170.755] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpFilePart=0x0) returned 0x58 [0170.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.755] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.756] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x70 [0170.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.758] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR", lpFilePart=0x0) returned 0x57 [0170.758] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", lpFilePart=0x0) returned 0x58 [0170.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xb38adc70, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38adc70, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.758] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.759] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpFilePart=0x0) returned 0x5d [0170.759] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpFilePart=0x0) returned 0x5e [0170.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.760] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.760] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x76 [0170.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.765] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us", lpFilePart=0x0) returned 0x5d [0170.765] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", lpFilePart=0x0) returned 0x5e [0170.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xb38d3dd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38d3dd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.766] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.766] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpFilePart=0x0) returned 0x58 [0170.766] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpFilePart=0x0) returned 0x59 [0170.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.771] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.771] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x71 [0170.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.773] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en", lpFilePart=0x0) returned 0x58 [0170.773] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", lpFilePart=0x0) returned 0x59 [0170.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb38d3dd0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38d3dd0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.773] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.774] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpFilePart=0x0) returned 0x58 [0170.774] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpFilePart=0x0) returned 0x59 [0170.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.777] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.778] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x71 [0170.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es", lpFilePart=0x0) returned 0x58 [0170.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", lpFilePart=0x0) returned 0x59 [0170.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb38f9f30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38f9f30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.780] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpFilePart=0x0) returned 0x58 [0170.780] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpFilePart=0x0) returned 0x59 [0170.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.782] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.782] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x71 [0170.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.784] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr", lpFilePart=0x0) returned 0x58 [0170.784] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", lpFilePart=0x0) returned 0x59 [0170.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb38f9f30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38f9f30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.785] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpFilePart=0x0) returned 0x5e [0170.785] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpFilePart=0x0) returned 0x5f [0170.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.786] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.786] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x77 [0170.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us", lpFilePart=0x0) returned 0x5e [0170.789] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", lpFilePart=0x0) returned 0x5f [0170.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb38f9f30, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb38f9f30, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.789] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpFilePart=0x0) returned 0x58 [0170.811] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpFilePart=0x0) returned 0x59 [0170.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.820] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.820] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x71 [0170.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.821] GetFileType (hFile=0x358) returned 0x1 [0170.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.821] GetFileType (hFile=0x358) returned 0x1 [0170.823] CloseHandle (hObject=0x358) returned 1 [0170.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.824] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR", lpFilePart=0x0) returned 0x58 [0170.824] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", lpFilePart=0x0) returned 0x59 [0170.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb396c350, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb396c350, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.825] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.826] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpFilePart=0x0) returned 0x5f [0170.826] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpFilePart=0x0) returned 0x60 [0170.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.829] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.829] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x78 [0170.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.832] GetFileType (hFile=0x358) returned 0x1 [0170.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.832] GetFileType (hFile=0x358) returned 0x1 [0170.842] CloseHandle (hObject=0x358) returned 1 [0170.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.842] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us", lpFilePart=0x0) returned 0x5f [0170.842] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", lpFilePart=0x0) returned 0x60 [0170.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb396c350, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb396c350, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.844] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.844] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpFilePart=0x0) returned 0x5b [0170.844] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpFilePart=0x0) returned 0x5c [0170.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.847] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.848] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x74 [0170.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.848] GetFileType (hFile=0x358) returned 0x1 [0170.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.848] GetFileType (hFile=0x358) returned 0x1 [0170.850] CloseHandle (hObject=0x358) returned 1 [0170.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.851] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us", lpFilePart=0x0) returned 0x5b [0170.851] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", lpFilePart=0x0) returned 0x5c [0170.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb39924b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb39924b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.853] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.853] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpFilePart=0x0) returned 0x56 [0170.853] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpFilePart=0x0) returned 0x57 [0170.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.855] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.855] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x6f [0170.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.860] GetFileType (hFile=0x358) returned 0x1 [0170.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.860] GetFileType (hFile=0x358) returned 0x1 [0170.861] CloseHandle (hObject=0x358) returned 1 [0170.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR", lpFilePart=0x0) returned 0x56 [0170.862] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", lpFilePart=0x0) returned 0x57 [0170.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xb39b8610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb39b8610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.863] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0170.863] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpFilePart=0x0) returned 0x5a [0170.863] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpFilePart=0x0) returned 0x5b [0170.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.865] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0170.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0170.866] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x73 [0170.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0170.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.866] GetFileType (hFile=0x358) returned 0x1 [0170.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0170.867] GetFileType (hFile=0x358) returned 0x1 [0170.868] CloseHandle (hObject=0x358) returned 1 [0170.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0170.868] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us", lpFilePart=0x0) returned 0x5a [0170.868] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", lpFilePart=0x0) returned 0x5b [0170.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb39b8610, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb39b8610, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.870] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0170.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0170.870] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x4f [0170.870] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x50 [0170.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.873] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0170.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.874] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x68 [0170.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0170.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.875] GetFileType (hFile=0x358) returned 0x1 [0170.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0170.876] GetFileType (hFile=0x358) returned 0x1 [0170.877] CloseHandle (hObject=0x358) returned 1 [0170.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0170.877] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x4f [0170.877] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x50 [0170.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb39de770, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb39de770, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.879] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0170.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0170.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0170.879] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", lpFilePart=0x0) returned 0x34 [0170.879] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpFilePart=0x0) returned 0x35 [0170.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.881] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0170.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0170.881] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x4d [0170.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0170.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0170.884] GetFileType (hFile=0x358) returned 0x1 [0170.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0170.884] GetFileType (hFile=0x358) returned 0x1 [0170.885] CloseHandle (hObject=0x358) returned 1 [0170.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0170.886] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF", lpFilePart=0x0) returned 0x34 [0170.886] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", lpFilePart=0x0) returned 0x35 [0170.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xb3a048d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb3a048d0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.887] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", lpFilePart=0x0) returned 0x38 [0170.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpFilePart=0x0) returned 0x39 [0170.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0170.891] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0170.893] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.enc", lpFilePart=0x0) returned 0x48 [0170.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0170.894] GetFileType (hFile=0x358) returned 0x1 [0170.894] GetFileType (hFile=0x358) returned 0x1 [0172.187] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpFilePart=0x0) returned 0x44 [0172.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0172.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0172.190] GetFileType (hFile=0x360) returned 0x1 [0172.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0172.191] GetFileType (hFile=0x360) returned 0x1 [0172.195] ReadFile (in: hFile=0x360, lpBuffer=0x128e21a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x128e21a0*, lpNumberOfBytesRead=0x2ee2b8*=0x100000, lpOverlapped=0x0) returned 1 [0172.251] GetCurrentActCtx (in: lphActCtx=0x2ee2e0 | out: lphActCtx=0x2ee2e0*=0x963ea8) returned 1 [0172.252] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0172.252] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.253] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.253] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.253] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.253] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.253] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.253] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.253] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.254] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.255] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x4015c, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.256] CallWindowProcW (lpPrevWndFunc=0x77a8b0ac, hWnd=0x50162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.256] NtdllDefWindowProc_W (hWnd=0x30268, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0172.302] WriteFile (in: hFile=0x358, lpBuffer=0x129e31b8*, nNumberOfBytesToWrite=0xff020, lpNumberOfBytesWritten=0x2ee2a8, lpOverlapped=0x0 | out: lpBuffer=0x129e31b8*, lpNumberOfBytesWritten=0x2ee2a8*=0xff020, lpOverlapped=0x0) returned 1 [0172.336] ReadFile (in: hFile=0x360, lpBuffer=0x128e21a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x128e21a0*, lpNumberOfBytesRead=0x2ee2b8*=0x20eb8, lpOverlapped=0x0) returned 1 [0172.351] GetCurrentActCtx (in: lphActCtx=0x2ee2e0 | out: lphActCtx=0x2ee2e0*=0x963ea8) returned 1 [0172.352] PeekMessageW (in: lpMsg=0x2ee230, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x2ee230) returned 0 [0172.408] ReadFile (in: hFile=0x360, lpBuffer=0x128e21a0, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x2ee2b8, lpOverlapped=0x0 | out: lpBuffer=0x128e21a0*, lpNumberOfBytesRead=0x2ee2b8*=0x0, lpOverlapped=0x0) returned 1 [0172.408] CloseHandle (hObject=0x360) returned 1 [0172.410] CloseHandle (hObject=0x358) returned 1 [0172.433] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", nBufferLength=0x105, lpBuffer=0x2eddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", lpFilePart=0x0) returned 0x44 [0172.433] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0172.436] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x51 [0172.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0172.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0172.437] GetFileType (hFile=0x358) returned 0x1 [0172.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0172.437] GetFileType (hFile=0x358) returned 0x1 [0172.439] CloseHandle (hObject=0x358) returned 1 [0172.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0172.440] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag", lpFilePart=0x0) returned 0x38 [0172.440] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", lpFilePart=0x0) returned 0x39 [0172.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb48bf0f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb48bf0f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.440] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb48bf0f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb48bf0f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.441] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0172.441] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb48bf0f0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb48bf0f0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb48bf0f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0172.441] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0172.441] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0172.441] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0172.442] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0172.442] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0172.442] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0172.442] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0172.442] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0172.443] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0172.443] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3a048d0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb3a048d0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb48bf0f0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x120ee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT.enc", cAlternateFileName="METCON~1.ENC")) returned 1 [0172.443] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0172.444] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0172.444] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0172.444] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0172.444] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0172.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0172.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0172.445] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", lpFilePart=0x0) returned 0x3d [0172.445] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpFilePart=0x0) returned 0x3e [0172.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.446] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.447] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0172.447] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0172.447] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0172.447] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0172.447] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0172.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0172.448] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x56 [0172.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0172.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0172.450] GetFileType (hFile=0x358) returned 0x1 [0172.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0172.450] GetFileType (hFile=0x358) returned 0x1 [0172.451] WriteFile (in: hFile=0x358, lpBuffer=0x2805638*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x2805638*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0172.453] CloseHandle (hObject=0x358) returned 1 [0172.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0172.453] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033", lpFilePart=0x0) returned 0x3d [0172.453] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", lpFilePart=0x0) returned 0x3e [0172.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb48e5250, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb48e5250, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.454] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb48e5250, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb48e5250, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.454] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb48e5250, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb48e5250, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb48e5250, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0172.454] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0172.455] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0172.455] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0172.455] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0172.455] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0172.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0172.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee290) returned 1 [0172.455] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", lpFilePart=0x0) returned 0x3e [0172.456] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", nBufferLength=0x105, lpBuffer=0x2edd20, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpFilePart=0x0) returned 0x3f [0172.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.458] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.458] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0172.458] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0172.458] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0172.459] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1e0) returned 1 [0172.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1a0) returned 1 [0172.459] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x57 [0172.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee0c0) returned 1 [0172.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0172.460] GetFileType (hFile=0x358) returned 0x1 [0172.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee030) returned 1 [0172.460] GetFileType (hFile=0x358) returned 0x1 [0172.460] WriteFile (in: hFile=0x358, lpBuffer=0x280c8f8*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee168, lpOverlapped=0x0 | out: lpBuffer=0x280c8f8*, lpNumberOfBytesWritten=0x2ee168*=0x77c, lpOverlapped=0x0) returned 1 [0172.462] CloseHandle (hObject=0x358) returned 1 [0172.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2f0) returned 1 [0172.462] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", nBufferLength=0x105, lpBuffer=0x2edde0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS", lpFilePart=0x0) returned 0x3e [0172.462] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", nBufferLength=0x105, lpBuffer=0x2edd80, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", lpFilePart=0x0) returned 0x3f [0172.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb490b3b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb490b3b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb490b3b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb490b3b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0172.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0172.466] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb490b3b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb490b3b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb490b3b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0172.467] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb490b3b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb490b3b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb490b3b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 0 [0172.467] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee240) returned 1 [0172.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee200) returned 1 [0172.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee240) returned 1 [0172.467] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", lpFilePart=0x0) returned 0x43 [0172.467] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", nBufferLength=0x105, lpBuffer=0x2edcd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpFilePart=0x0) returned 0x44 [0172.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2edee0 | out: lpFindFileData=0x2edee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0172.468] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0172.469] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0172.469] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0172.469] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0172.469] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf30 | out: lpFindFileData=0x2edf30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0172.469] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee190) returned 1 [0172.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee150) returned 1 [0172.470] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edb90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x5c [0172.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee070) returned 1 [0172.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0172.472] GetFileType (hFile=0x358) returned 0x1 [0172.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0172.472] GetFileType (hFile=0x358) returned 0x1 [0172.473] WriteFile (in: hFile=0x358, lpBuffer=0x2814378*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee118, lpOverlapped=0x0 | out: lpBuffer=0x2814378*, lpNumberOfBytesWritten=0x2ee118*=0x77c, lpOverlapped=0x0) returned 1 [0172.474] CloseHandle (hObject=0x358) returned 1 [0172.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2a0) returned 1 [0172.475] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", nBufferLength=0x105, lpBuffer=0x2edd90, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033", lpFilePart=0x0) returned 0x43 [0172.475] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", nBufferLength=0x105, lpBuffer=0x2edd30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", lpFilePart=0x0) returned 0x44 [0172.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2edf40 | out: lpFindFileData=0x2edf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb490b3b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb490b3b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.475] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb490b3b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb490b3b0, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.475] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0172.476] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb490b3b0, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb490b3b0, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb4931510, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0172.476] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0172.476] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0172.476] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0172.477] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0172.477] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edf90 | out: lpFindFileData=0x2edf90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0172.477] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0172.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1b0) returned 1 [0172.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0172.477] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", lpFilePart=0x0) returned 0x3c [0172.477] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpFilePart=0x0) returned 0x3d [0172.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.479] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.479] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0172.480] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0172.480] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0172.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0172.480] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Decrypt Instructions.txt", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Decrypt Instructions.txt", lpFilePart=0x0) returned 0x55 [0172.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0172.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\Decrypt Instructions.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\decrypt instructions.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x358 [0172.481] GetFileType (hFile=0x358) returned 0x1 [0172.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee080) returned 1 [0172.481] GetFileType (hFile=0x358) returned 0x1 [0172.481] WriteFile (in: hFile=0x358, lpBuffer=0x281b828*, nNumberOfBytesToWrite=0x77c, lpNumberOfBytesWritten=0x2ee1b8, lpOverlapped=0x0 | out: lpBuffer=0x281b828*, lpNumberOfBytesWritten=0x2ee1b8*=0x77c, lpOverlapped=0x0) returned 1 [0172.482] CloseHandle (hObject=0x358) returned 1 [0172.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee340) returned 1 [0172.483] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", nBufferLength=0x105, lpBuffer=0x2ede30, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine", lpFilePart=0x0) returned 0x3c [0172.483] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", lpFilePart=0x0) returned 0x3d [0172.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2edfe0 | out: lpFindFileData=0x2edfe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb4931510, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb4931510, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.483] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xb4931510, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb4931510, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.483] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4931510, ftCreationTime.dwHighDateTime=0x1d6002e, ftLastAccessTime.dwLowDateTime=0xb4931510, ftLastAccessTime.dwHighDateTime=0x1d6002e, ftLastWriteTime.dwLowDateTime=0xb4931510, ftLastWriteTime.dwHighDateTime=0x1d6002e, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Decrypt Instructions.txt", cAlternateFileName="DECRYP~1.TXT")) returned 1 [0172.484] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0172.484] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2ee030 | out: lpFindFileData=0x2ee030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0172.484] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee290) returned 1 [0172.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee250) returned 1 [0172.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee2e0) returned 1 [0172.484] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", nBufferLength=0x105, lpBuffer=0x2eddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery", lpFilePart=0x0) returned 0x39 [0172.484] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", nBufferLength=0x105, lpBuffer=0x2edd70, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", lpFilePart=0x0) returned 0x3a [0172.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2edf80 | out: lpFindFileData=0x2edf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0820 [0172.548] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.564] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0172.564] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0172.564] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0172.564] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0172.565] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0172.565] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0172.565] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0172.565] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0172.565] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0172.565] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0172.566] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0172.566] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0172.566] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0172.566] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0172.566] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0172.566] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0172.567] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0172.567] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0172.567] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0172.567] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0172.567] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0172.567] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0172.568] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0172.568] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0172.568] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0172.569] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0172.569] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0172.569] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0172.569] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0172.569] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0172.569] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0172.570] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0172.570] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0172.570] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0172.570] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0172.570] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0172.571] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0172.571] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0172.571] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0172.571] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0172.571] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0172.572] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0172.572] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0172.572] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0172.572] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0172.573] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0172.573] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0172.573] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0172.573] FindNextFileW (in: hFindFile=0x9c0820, lpFindFileData=0x2edfd0 | out: lpFindFileData=0x2edfd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0172.573] FindClose (in: hFindFile=0x9c0820 | out: hFindFile=0x9c0820) returned 1 [0172.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee230) returned 1 [0172.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee1f0) returned 1 [0172.576] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.enc", lpFilePart=0x0) returned 0x47 [0172.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0172.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0172.578] GetFileType (hFile=0x358) returned 0x1 [0172.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0172.578] GetFileType (hFile=0x358) returned 0x1 [0174.090] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", lpFilePart=0x0) returned 0x43 [0174.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0174.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0174.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0174.099] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.enc", lpFilePart=0x0) returned 0x4f [0174.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0174.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0174.100] GetFileType (hFile=0x360) returned 0x1 [0174.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0174.100] GetFileType (hFile=0x360) returned 0x1 [0175.525] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", lpFilePart=0x0) returned 0x4b [0175.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0175.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0175.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0175.530] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.enc", lpFilePart=0x0) returned 0x48 [0175.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0175.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0175.531] GetFileType (hFile=0x34c) returned 0x1 [0175.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0175.531] GetFileType (hFile=0x34c) returned 0x1 [0176.849] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", lpFilePart=0x0) returned 0x44 [0176.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0176.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0176.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0176.855] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.enc", lpFilePart=0x0) returned 0x4e [0176.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0176.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f8 [0176.856] GetFileType (hFile=0x2f8) returned 0x1 [0176.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0176.856] GetFileType (hFile=0x2f8) returned 0x1 [0178.401] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", lpFilePart=0x0) returned 0x4a [0178.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0178.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0178.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0178.407] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.enc", lpFilePart=0x0) returned 0x4c [0178.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0178.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0178.408] GetFileType (hFile=0x320) returned 0x1 [0178.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0178.409] GetFileType (hFile=0x320) returned 0x1 [0180.228] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", lpFilePart=0x0) returned 0x48 [0180.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0180.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0180.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0180.233] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.enc", lpFilePart=0x0) returned 0x47 [0180.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0180.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x158 [0180.235] GetFileType (hFile=0x158) returned 0x1 [0180.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0180.235] GetFileType (hFile=0x158) returned 0x1 [0181.445] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", lpFilePart=0x0) returned 0x43 [0181.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0181.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0181.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0181.450] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.enc", lpFilePart=0x0) returned 0x4a [0181.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0181.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x35c [0181.451] GetFileType (hFile=0x35c) returned 0x1 [0181.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0181.451] GetFileType (hFile=0x35c) returned 0x1 [0182.726] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", lpFilePart=0x0) returned 0x46 [0182.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0182.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0182.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0182.730] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.enc", lpFilePart=0x0) returned 0x4f [0182.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0182.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f8 [0182.732] GetFileType (hFile=0x2f8) returned 0x1 [0182.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0182.732] GetFileType (hFile=0x2f8) returned 0x1 [0184.130] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", lpFilePart=0x0) returned 0x4b [0184.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0184.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0184.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0184.137] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.enc", lpFilePart=0x0) returned 0x49 [0184.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0184.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x360 [0184.139] GetFileType (hFile=0x360) returned 0x1 [0184.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0184.139] GetFileType (hFile=0x360) returned 0x1 [0185.422] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", lpFilePart=0x0) returned 0x45 [0185.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0185.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0185.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0185.429] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.enc", lpFilePart=0x0) returned 0x4d [0185.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0185.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0185.430] GetFileType (hFile=0x320) returned 0x1 [0185.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0185.430] GetFileType (hFile=0x320) returned 0x1 [0186.837] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", lpFilePart=0x0) returned 0x49 [0186.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0186.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0186.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0186.841] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.enc", lpFilePart=0x0) returned 0x50 [0186.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0186.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x158 [0186.841] GetFileType (hFile=0x158) returned 0x1 [0186.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0186.841] GetFileType (hFile=0x158) returned 0x1 [0188.641] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", lpFilePart=0x0) returned 0x4c [0188.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0188.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0188.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eaac0) returned 1 [0188.646] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.enc", nBufferLength=0x105, lpBuffer=0x2edca0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.enc", lpFilePart=0x0) returned 0x4d [0188.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee180) returned 1 [0188.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.enc" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.enc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x358 [0188.647] GetFileType (hFile=0x358) returned 0x1 [0188.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee0f0) returned 1 [0188.647] GetFileType (hFile=0x358) returned 0x1 Thread: id = 2 os_tid = 0xb94 Thread: id = 3 os_tid = 0xb98 [0059.304] CoGetContextToken (in: pToken=0x120f800 | out: pToken=0x120f800) returned 0x800401f0 [0059.305] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0094.219] CloseHandle (hObject=0x354) returned 1 [0144.274] WriteFile (in: hFile=0x2f8, lpBuffer=0x27e7f48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27e7f48*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0144.276] CloseHandle (hObject=0x2f8) returned 1 [0154.822] WriteFile (in: hFile=0x320, lpBuffer=0x27f3b78*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27f3b78*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0154.823] CloseHandle (hObject=0x320) returned 1 [0154.827] WriteFile (in: hFile=0x158, lpBuffer=0x27f7d40*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27f7d40*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0154.828] CloseHandle (hObject=0x158) returned 1 [0164.854] WriteFile (in: hFile=0x320, lpBuffer=0x27fb7e0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27fb7e0*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0164.855] CloseHandle (hObject=0x320) returned 1 [0164.860] WriteFile (in: hFile=0x158, lpBuffer=0x27fa630*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27fa630*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0164.861] CloseHandle (hObject=0x158) returned 1 [0172.366] WriteFile (in: hFile=0x35c, lpBuffer=0x27f5ee8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27f5ee8*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0172.369] CloseHandle (hObject=0x35c) returned 1 [0172.374] WriteFile (in: hFile=0x158, lpBuffer=0x27f3ba8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27f3ba8*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0172.375] CloseHandle (hObject=0x158) returned 1 [0172.379] WriteFile (in: hFile=0x320, lpBuffer=0x27f4d48*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27f4d48*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0172.381] CloseHandle (hObject=0x320) returned 1 [0172.383] WriteFile (in: hFile=0x2f8, lpBuffer=0x27f1860*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27f1860*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0172.385] CloseHandle (hObject=0x2f8) returned 1 [0172.388] WriteFile (in: hFile=0x34c, lpBuffer=0x27f2a08*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27f2a08*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0172.389] CloseHandle (hObject=0x34c) returned 1 [0182.421] WriteFile (in: hFile=0x34c, lpBuffer=0x27fe000*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27fe000*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0182.423] CloseHandle (hObject=0x34c) returned 1 [0182.424] WriteFile (in: hFile=0x358, lpBuffer=0x27fbca8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27fbca8*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0182.425] CloseHandle (hObject=0x358) returned 1 [0182.426] WriteFile (in: hFile=0x158, lpBuffer=0x2801500*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x2801500*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0182.427] CloseHandle (hObject=0x158) returned 1 [0182.428] WriteFile (in: hFile=0x320, lpBuffer=0x2800360*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x2800360*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0182.429] CloseHandle (hObject=0x320) returned 1 [0182.430] WriteFile (in: hFile=0x360, lpBuffer=0x27fce58*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27fce58*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0182.431] CloseHandle (hObject=0x360) returned 1 [0182.432] WriteFile (in: hFile=0x2f8, lpBuffer=0x27ff1b0*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x120f5e8, lpOverlapped=0x0 | out: lpBuffer=0x27ff1b0*, lpNumberOfBytesWritten=0x120f5e8*=0x20, lpOverlapped=0x0) returned 1 [0182.433] CloseHandle (hObject=0x2f8) returned 1 Thread: id = 4 os_tid = 0xb1c Thread: id = 5 os_tid = 0x5e4 Thread: id = 6 os_tid = 0x348 Thread: id = 7 os_tid = 0x9e4 Process: id = "2" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x204e8000" os_pid = "0xbac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xb14" cmd_line = "\"C:\\Windows\\System32\\vssadmin.exe\" delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x5e0 Thread: id = 9 os_tid = 0x43c Thread: id = 10 os_tid = 0x670 Thread: id = 11 os_tid = 0x290 Thread: id = 12 os_tid = 0x7a8 Process: id = "3" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x1f719000" os_pid = "0x564" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005b69a" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 13 os_tid = 0x308 Thread: id = 14 os_tid = 0x5d8 Thread: id = 15 os_tid = 0x7a0 Thread: id = 16 os_tid = 0x114 [0092.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefdbc0 | out: lpSystemTimeAsFileTime=0xefdbc0*(dwLowDateTime=0x85651450, dwHighDateTime=0x1d6002e)) [0092.472] GetCurrentProcessId () returned 0x564 [0092.474] GetCurrentThreadId () returned 0x114 [0092.474] GetTickCount () returned 0x11495f9 [0092.474] QueryPerformanceCounter (in: lpPerformanceCount=0xefdbc8 | out: lpPerformanceCount=0xefdbc8*=21162642424) returned 1 [0092.474] malloc (_Size=0x100) returned 0x548e80 [0198.387] free (_Block=0x548e80) Thread: id = 17 os_tid = 0x208 Thread: id = 18 os_tid = 0x10c Thread: id = 19 os_tid = 0x560 Thread: id = 34 os_tid = 0x600 Thread: id = 41 os_tid = 0x8b8 Thread: id = 48 os_tid = 0xec Process: id = "4" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 20 os_tid = 0x7b8 Thread: id = 21 os_tid = 0x768 Thread: id = 22 os_tid = 0x764 Thread: id = 23 os_tid = 0x758 Thread: id = 24 os_tid = 0x724 Thread: id = 25 os_tid = 0x718 Thread: id = 26 os_tid = 0x714 Thread: id = 27 os_tid = 0x630 Thread: id = 28 os_tid = 0x154 Thread: id = 29 os_tid = 0x150 Thread: id = 30 os_tid = 0x120 Thread: id = 31 os_tid = 0x124 Thread: id = 32 os_tid = 0x118 Thread: id = 33 os_tid = 0xf0 Thread: id = 43 os_tid = 0x928 Thread: id = 44 os_tid = 0x8e8 Thread: id = 45 os_tid = 0x614 Thread: id = 46 os_tid = 0x2ac Thread: id = 47 os_tid = 0xd8 Thread: id = 50 os_tid = 0x35c Thread: id = 51 os_tid = 0x49c Thread: id = 52 os_tid = 0x6dc Process: id = "5" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x6dd1e000" os_pid = "0x138" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005bae0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 35 os_tid = 0x6dc Thread: id = 36 os_tid = 0x24c Thread: id = 37 os_tid = 0x634 Thread: id = 38 os_tid = 0x7dc Thread: id = 39 os_tid = 0x540 Thread: id = 40 os_tid = 0x40c Thread: id = 42 os_tid = 0x8c8 Thread: id = 49 os_tid = 0xb44 Process: id = "6" image_name = "System" filename = "" page_root = "0x187000" os_pid = "0x4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "kernel_analysis" parent_id = "0" os_parent_pid = "0xffffffffffffffff" cmd_line = "" cur_dir = "" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 53 os_tid = 0x8 Thread: id = 54 os_tid = 0xc0 Thread: id = 55 os_tid = 0x3c Thread: id = 56 os_tid = 0x5c Thread: id = 57 os_tid = 0xb0 Thread: id = 58 os_tid = 0xb4 Thread: id = 59 os_tid = 0x60 Thread: id = 60 os_tid = 0xc8 Thread: id = 61 os_tid = 0x4c Thread: id = 62 os_tid = 0x28 Thread: id = 63 os_tid = 0x40 Thread: id = 64 os_tid = 0x44 Thread: id = 65 os_tid = 0x38 Thread: id = 66 os_tid = 0xc4 Thread: id = 67 os_tid = 0xcc Thread: id = 68 os_tid = 0xd0 Thread: id = 69 os_tid = 0xb8 Thread: id = 70 os_tid = 0xd4 Thread: id = 71 os_tid = 0xd8 Thread: id = 72 os_tid = 0xdc Thread: id = 74 os_tid = 0xe8 Thread: id = 76 os_tid = 0x64 Thread: id = 78 os_tid = 0x9c Thread: id = 79 os_tid = 0x80 Thread: id = 80 os_tid = 0x34 Thread: id = 81 os_tid = 0x30 Thread: id = 82 os_tid = 0x48 Thread: id = 83 os_tid = 0x2c Thread: id = 84 os_tid = 0xfc Thread: id = 85 os_tid = 0x100 Thread: id = 86 os_tid = 0x104 Thread: id = 87 os_tid = 0x10c Thread: id = 88 os_tid = 0x110 Thread: id = 89 os_tid = 0x114 Thread: id = 90 os_tid = 0x108 Thread: id = 91 os_tid = 0x78 Thread: id = 92 os_tid = 0x24 Thread: id = 93 os_tid = 0x118 Thread: id = 94 os_tid = 0x11c Thread: id = 95 os_tid = 0x120 Thread: id = 96 os_tid = 0x50 Thread: id = 100 os_tid = 0x13c Thread: id = 101 os_tid = 0x90 Thread: id = 102 os_tid = 0x140 Thread: id = 103 os_tid = 0x144 Thread: id = 104 os_tid = 0x148 Thread: id = 121 os_tid = 0x19c Thread: id = 129 os_tid = 0x68 Thread: id = 130 os_tid = 0x20 Process: id = "7" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x2caca000" os_pid = "0xe0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x4" cmd_line = "\\SystemRoot\\System32\\smss.exe" cur_dir = "C:\\Windows" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 73 os_tid = 0xe4 Thread: id = 75 os_tid = 0xec Thread: id = 97 os_tid = 0x128 Thread: id = 109 os_tid = 0x16c Process: id = "8" image_name = "autochk.exe" filename = "c:\\windows\\system32\\autochk.exe" page_root = "0x2ca19000" os_pid = "0xf0" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xe0" cmd_line = "\\??\\C:\\Windows\\system32\\autochk.exe *" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 77 os_tid = 0xf4 Process: id = "9" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x2c773000" os_pid = "0x12c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xe0" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000000 0000003c " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 98 os_tid = 0x130 Process: id = "10" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0x2c4ad000" os_pid = "0x134" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x12c" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 99 os_tid = 0x138 Thread: id = 105 os_tid = 0x14c Thread: id = 106 os_tid = 0x150 Thread: id = 107 os_tid = 0x154 Thread: id = 108 os_tid = 0x158 Thread: id = 117 os_tid = 0x190 Thread: id = 122 os_tid = 0x1a0 Thread: id = 123 os_tid = 0x1a4 Thread: id = 128 os_tid = 0x1c0 Thread: id = 137 os_tid = 0x1e0 Process: id = "11" image_name = "smss.exe" filename = "c:\\windows\\system32\\smss.exe" page_root = "0x2ba79000" os_pid = "0x15c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xe0" cmd_line = "\\SystemRoot\\System32\\smss.exe 00000001 0000003c " cur_dir = "C:\\Windows\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 110 os_tid = 0x160 Process: id = "12" image_name = "wininit.exe" filename = "c:\\windows\\system32\\wininit.exe" page_root = "0x2beb3000" os_pid = "0x164" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x12c" cmd_line = "wininit.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 111 os_tid = 0x168 Thread: id = 118 os_tid = 0x194 Thread: id = 119 os_tid = 0x198 Thread: id = 125 os_tid = 0x1ac Thread: id = 126 os_tid = 0x1b0 Thread: id = 127 os_tid = 0x1bc Thread: id = 140 os_tid = 0x1f0 Thread: id = 141 os_tid = 0x1f4 Process: id = "13" image_name = "csrss.exe" filename = "c:\\windows\\system32\\csrss.exe" page_root = "0x2b7f2000" os_pid = "0x170" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x15c" cmd_line = "%SystemRoot%\\system32\\csrss.exe ObjectDirectory=\\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 112 os_tid = 0x174 Thread: id = 113 os_tid = 0x178 Thread: id = 114 os_tid = 0x17c Thread: id = 115 os_tid = 0x180 Thread: id = 116 os_tid = 0x184 Thread: id = 124 os_tid = 0x1a8 Process: id = "14" image_name = "winlogon.exe" filename = "c:\\windows\\system32\\winlogon.exe" page_root = "0x2b6f8000" os_pid = "0x188" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x15c" cmd_line = "winlogon.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 120 os_tid = 0x18c Thread: id = 134 os_tid = 0x1d4 Thread: id = 135 os_tid = 0x1d8 Process: id = "15" image_name = "services.exe" filename = "c:\\windows\\system32\\services.exe" page_root = "0x2a76b000" os_pid = "0x1b4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x164" cmd_line = "C:\\Windows\\system32\\services.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 131 os_tid = 0x1b8 Process: id = "16" image_name = "lsass.exe" filename = "c:\\windows\\system32\\lsass.exe" page_root = "0x2a276000" os_pid = "0x1c4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x164" cmd_line = "C:\\Windows\\system32\\lsass.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 132 os_tid = 0x1c8 Thread: id = 136 os_tid = 0x1dc Thread: id = 138 os_tid = 0x1e4 Thread: id = 139 os_tid = 0x1e8 Thread: id = 142 os_tid = 0x1ec Thread: id = 143 os_tid = 0x1f8 Process: id = "17" image_name = "lsm.exe" filename = "c:\\windows\\system32\\lsm.exe" page_root = "0x29d7d000" os_pid = "0x1cc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x164" cmd_line = "C:\\Windows\\system32\\lsm.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 133 os_tid = 0x1d0